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INTRODUCTION  AND  OVERVIEW 
RELIABILITY  UNDER  AUSTERITY 


E.Keonjian 

Engineering  Consultant 
P.O.Box  232.  Greenvale 
New  York  1 1 548 
U.S.A. 

(Lecture  Series  Director) 


SUMMARY 

Reliability  is  that  intangible  capability  lor  future  desired  performance  from  a functional  device,  While 
it  can  be  promised,  certified,  warranted,  and  guaranteed,  its  presence  cannot  be  really  verified  without  exploring 
or  simulating  future  operating  experience.  The  general  public  in  choosing  consumer  products  is  vastly  assisted  in 
making  selections  by  a particular  product’s  public  acceptance,  acclaim,  and  by  publicized  repair  and  replacement 
experience,  all  this  in  areas  of  strong  product  competition.  The  buyers  of  a new  and  unproven  product  belong  to 
the  “Ict’s-take-a-chance"  fraternity  and  are  closely  observed  by  the  preponderance  of  those  in  the  marketplace  and 
also  by  would-be  product  competitors.  The  years  spent  in  achieving  for  a product  the  public  recognition  as  the 
most  reliable  refrigerator,  washing  machine,  or  even  automobile  are  so  treasured  and  carefully  protected  that  the 
smallest  alteration  in  design  to  create  a new  model  usually  justifies  unbelievable  effort  in  life  testing,  trial 
production,  field  test,  and  other  protection  for  the  reliability  reputation,  for  a high  reputation,  years  in  building, 
can  be  lost  overnight. 

The  electronics  field  in  general,  and  avionics  in  particular  have  made  and  are  still  making  revolutionary  progress 
in  pushing  forward  the  technical  state-of-the-art.  The  almost  total  replacement  of  thermionic  tubes  by  solid  state 
devices,  the  astronomical  expansion  of  computing  capability,  the  tremendously  successful  exploitation  of  digital 
rather  than  analog  design,  all  these  when  coupled  with  the  influx  of  vast  numbers  of  extremely  enthusiastic  and 
creative  electronic  designers  have  brought  the  wildest  fantasies  of  technology  seemingly  within  our  grasp.  All  we  need 
is  mote  reliability  which  means  even  more  money  and  extensive  patience  and  thoroughness  during  design  and  develop- 
ment. 

Much  of  the  magnitude  of  the  design  problem  seems  to  be  created  by  the  spread  in  breadth  of  the  avionics 
state-of-the-art.  more  rapid  than  either  hurried  growth  of  academic  capacity,  or  available  apprenticeships  and  on-the-job 
learning.  Unfortunately  there  has  been  too  much  of  a market  for  inrovative  but  incomplete  design,  design  which 
achieves  creditable  performance  only  part  of  the  time  or  unreliably.  This  basic  problem  is  compounded  by  the  high 
exist  of  new  development—  costs  high  enough  to  eliminate  all  customers  save  the  military  who  have  been  conditioned 
over  many  recent  years  to  accept  less  reliability  than  is  tolerated  by  the  public  at  large.  But  now  it  appears  that 
this  picture  is  changing. 

The  scarcity  of  funds  for  military  procurement,  and  the  publicity  given  to  chronic  unreliability  p-oblems  are 
creating  procurement  demands  for  reliability  guarantees,  warranties,  and  life  cycle  cost  studies. 

The  program  covered  by  Lecture  Series  No. 8 1 addresses  and  discusses  problems  of  avionic  unreliability. 

Described  are  typical  methods  for  forcing  reliability  into  new  design  and  development,  into  new  procurement 
requirements.  Included  jre  typical  life  cycle  costs  as  affected  by  the  reliability  achieved.  The  case  for  improving 
initial  designs  with  more  background  experience,  greater  patience  and  thoroughness  by  the  designer  is  viewed  as 
perhaps  the  soundest  and  in  the  long  run  the  most  economical  means  for  reliability  attainment.  Case  histories; 
involving  both  reliability  testing  and  field  reliability  achievement  will  be  described.  Of  special  interest  is  the 
opportunity  to  review  problems  and  recommendations  from  a multi-national  viewpoint. 

As  in  previous  Lecture  Series,  the  'ast  item  on  the  program  is  a panel  discussion  which  will  give  the  audience  the 
almost  unlimited  opportunity  to  further  explore  areas  of  special  interest  with  any  of  the  speakers. 
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AVIONICS  RELIABILITY  CONTROL  DURING  DEVELOPMENT 

* George  T.  Bird 
*G.  Ronald  Herd 


SUMMARY 


A comparison  is  made  between  actual  reliability  growth  observed  during  recent  years  and  the  inherent 
reliability  potential  for  avionics  equipment.  A method  of  control  is  presented  integrating  prediction  pro- 
cedures currently  outlined  in  MIL-STD-756  and  MIL-HDBK-217  with  development  testing.  A nomograph  is 
presented  for  determining  the  amount  of  design  support  testing  which  will  be  required  to  achieve  a desired 
or  specified  value  of  avionics  equipment  reliability.  The  paper  shows  how  these  control  procedures  are 
used  for  specification,  design  planning,  testing,  and  monitoring  high  reliability  achievement  in  avionics 
equipment. 

INTRODUCTION 


Recently,  reliability  specifications  established  for  a new  generation  of  avionics  equipment  exceeded 
the  achieved  reliability  by  a factor  of  ten  even  though  the  achieved  reliability  was  a 100%  improvement 
over  the  preceding  generation.  The  reliability  desired  for  the  next  generation  ot  avionics  equipment  will 
be  even  greater  because  of  additional  automatic  and  self-control  features.  To  close  this  broad  gap  between 
requirement  and  achievement,  a more  concerted  effort  on  reliability  control  during  the  RAD  phase  is  needed. 

System  reliability  in  its  opera' ional  role  can  be  defined  and  measured  in  terms  of  at  least  two  inter- 
dependent and  intrarelated  parameters  --  functional  performance  and  reliability.  Actual  measurement  of 
reliability,  as  a composite  of  the  functional  parameters  working  in  unison  over  time,  has  not  been  prac- 
ticable until  late  in  the  development  stage.  However,  it  is  now  practicable  to  develop  an  accurate  deter- 
mination of  the  reliability  potential  of  a given  system  design,  based  upon  analytical  and  empirical  "measure- 
ments" of  individual  parameters  at  critical  decision  points  in  both  the  concept  formulation  and  the  design 
phases.  These  measurements  enable  a manager  to  evaluate  and  control  system  reliability  as  an  inherent 
"built-in"  feature  of  the  design  in  the  very  early  formative  stages  of  its  evolution,  when  design  deficiencies 
can  be  most  economically  discovered  and  corrected. 

It  is  our  belief  that  the  required  level  of  reliabi’ity  can  be  systematically  designed  into  an  equipment 
if  the  designer  is  given  the  time,  facilities,  and  management  support  required  to  specifically  identify  and 
circumvent  the  failure  modes  which,  potentially,  would  jeopardize  the  inherent  reliability  of  the  design. 
Reliability  of  some  of  the  more  complex  avionics  system  designs  could  be  enhanced  by  as  much  as  an  order 
of  magnitude,  and  more,  if  design  verification  encompassing  design-proof  testing  were  contractually  stipu- 
lated and  rigorously  applied  in  acquisition  programs. 

RELIABILITY  GROWTH  HISTORY 


An  investigative  study  by  Bird  Associates  assessed  reliability  growth  in  avionics  systems  over  the 
past  decade.  The  study  consisted  of  a review  of  experience  data  accrued  during  a six-month  period  in 
1970  on  98  generic  types  of  avionics  equipment  used  in  a variety  of  aircraft.  Of  these,  35  types  were  pro- 
cured with  a contractually  specified  reliability  requirement.  Current  reliability  status  of  all  98  equipment 
types  was  determined  or.  the  basis  of  field  data.  A comparison  was  then  made  between  the  reliability  status 
of  this  cross  section  of  avionics  equipment,  which  were  operational  in  1970,  and  the  reliability  of  a cross 
section  of  operational  avionics  equipment  which  were  studied  in  about  1958.  This  comparison  was  made  to 
measure  the  reliability  "growth"  in  avionics  equipment  design  between  the  two  operational  periods  and  to 
evaluate  the  reliability  potential  which  might  be  achieved  in  future  acquisition  programs. 

The  results  of  this  study  indicated  that,  on  the  average,  an  improvement  of  2.  3 to  1 in  MTBF  was 
achieved  for  those  equipments  procured  with  a reliability  specification  when  compared  to  1958  operational 
equipments.  An  improvement  of  only  1.6  to  1 was  realized  for  equipments  procured  without  a reliability 
specification  when  compared  to  1958  operational  equipments.  The  calendar  time  between  these  studies  of 
12  years  is  approximately  1.2  generations  of  system  design,  so  a measure  of  equipment  reliability  growth 
per  system  generation  is  100%  (2:1)  for  those  procured  with  a reliability  specification  and  50%  (1.5:1)  tor 
those  without  specified  requirements.  Viewing  this  growth  another  way  for  new  systems  entering  opera- 
tional status  each  year,  those  procured  with  a reliability  specification  will  have,  on  the  average,  an  MTBF 
7.2%  greater  than  those  of  the  previous  year;  for  those  procured  with  a reliability  specification,  the  MTBF 
will  be  4.0%  greater  than  in  the  previous  year's  new  systems.  Since  the  contractually  imposed  reliability 
specifications  did  not  require  verification  through  demonstration  testing,  a 15%  gain  per  year  is  potentially 
achievable,  corresponding  to  a fourfold  increase  per  generation. 

Based  upon  the  observed  gains  between  1958  and  1970  for  the  two  methods  of  procurement,  the  relia- 
bility achievement  of  a typical  operational  avionics  equipment  is  projected  for  a future  point  in  time, 
Illustrated  in  Figure  1.  The  expected  MTBFs  for  typical  opera. ional  avionics  equipments  in  1980  are 
detailed  in  Table  1 for  three  levels  of  complexity,  under  the  assumption  that  the  growth  observed  in  the 
1958-70  period  is  continued. 

• Bird  Engineering  Research  Associa’cs  Inc.,  Vienna,  Virginia,  U.S.A. 


MEAN  TIME  BETWEEN  FAILURES  (MTBF)  IN  HOURS 


Figure  1.  Avionics  Equipment  MTBF  for  Various  Levels  of  Complexity 
Observed  at  Four  Times  for  Different  Types  of  P-ocurement 


Table  1.  Reliability  (MTBF)  Achievement  Observed 
and  Projected  for  Various  Levels  of  Complexity  (AEGs) 
for  Procurement  With  and  Without  Reliability  Specification 


AEG 

Observation  Time 

Observed 

MTBF 

1958 

Observed 

MTBF 

1970 

"Expected" 

MTBF 

1980 

"Projected" 

MTBF 

1990 

With  Specific 

it  ion 

50 

299 

598 

1196 

100 

115 

230 

460 

200 

48 

92 

184 

500 

13.8 

27.6 

55 

1000 

5.5 

11 

22 

Without  Speci 

fication 

50 

130 

208 

312 

468 

100 

50 

80 

120 

180 

200 

20 

32 

48 

72 

500 

6 

9.6 

14.4 

21.6 

1000 

2.4 

3.8 

5.8 

8.6 

Extrapolation  of  the  4tro,  7%,  and  15To  annual  growth  in  MTBF  postulated  from  the  above  analysis  is 
presented  in  Figure  2 for  a system  with  the  equivalent  _omp  exity  of  200  AEGs.  This  extrapolation 
through  one  generation  does  not  extend  to  the  region  where  cons  raints  imposed  by  parts  limitations,  as 
indicated  by  MIL-HDBK-2  17,  would  invalidate  tne  projection.  From  this  projection,  there  is  a range  of 
41  in  the  next  generation  MTBFs  between  tight  "reliability-specification1'  acquisitions  and  those  with  no 
specified  reliability. 
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Figure  2.  Reliability  (MTBF)  Achir  -ement  of  a Typical  200- AEG  Avionics  Equipment  in  an 
Operational  Environment  Projected  One  Generation  Unoer  Different  Procurement  Rules 


Evi  unce  from  field  data  indicates  that  current  reliability  maturity  achieved  in  avionics  equipment  is 
about  one-sixth  of  the  specified  MTBF  (fig)  requirement,  averaged  across  the  35  equipments  studied.  By 
still  another  yardstick,  MTBF  of  these  35  equipments  (on  the  average)  had  achieved  approximately  one- 
tenth  of  their  predicted  MTBF  (6p)  as  determined  from  MIL-HDBK-217  failure-rate  analysis  unde  the 
assumed  airborne  environment.  Even  though  we  have  observed  approximately  7.5%  growth  rate  per  year 
in  equipment  MTBF,  it  is  clear  that  we  have  not  come  close  to  the  reliability  design  potential  of  any  given 
equipment  with  our  initial  design  effort.  We  can  improve  this  situation,  however,  through  established 
reliability  improvement  procedures  applied  during  the  development  phase  --  before  release  of  the  proto- 
type to  production/deployment  phases. 

By  monitoring  MTBF  growth  during  the  development  phase,  we  can  make  some  projection  on  how  much 
development  testing  would  be  required  to  achieve  the  specified  MTBF  requirement.  How  quickly  a reduc- 
tion in  failure  rate  is  achieved  is  a function  of  the  effectiveness  of  the  design/test/analysis  team,  since  the 
test  time  required  to  achieve  a given  MTBF  goal  is  a function  of  both  the  speed  with  which  the  failure  rate 
can  be  reduced  and  the  amount  of  failure-rate  reduction  required. 

There  are  two  general  methods  that  can  be  used  to  increase  reliability  in  the  design  of  a system: 

(1)  reduction  of  average  str  ess  through  such  effo.  ts  as  parts  selection,  applications,  load  sharing,  etc. ; 
and  (2)  reduction  in  variability  among  failure  mechanisms  resulting  in  more  homogeneity  in  the  effects  of 
stress.  The  first  effort  is  usually  resolved  thr  ough  analytical  and  empirical  procedures,  while  the  second 
usually  requires  empirical  results  from  such  things  as  development  testing. 

Consider,  for  example,  the  failure  rates  among  failure  mechanisms  within  an  equipment,  as  illus- 
trated on  Scale  A in  Figure  3 The  spread  of  failure  rates  is  typical  of  what  exists  within  a system. 

Design  analysis  usually  shifts  the  total  scale  to  the  left  or  the  failure  rates  to  the  right  as  shown  by  Scale  B, 
and  eliminates  a fe  v of  the  lower  failure  rates  by  designing  out  the  failure  mechanism,  thus  shifting  that 
particular  rate  to  tt  .*  right.  Development  tests  usually  identify  the  higher  failure  rates  (illustrated  on  the 
left)  through  repeated  failure  modes.  Elimination  or  reduction  of  these  modes  by  designing  around  the 
mechanism  improves  reliability.  This  is  the  key  to  high  reliability  that  is  usually  overlooked  in  develop- 
ment programs. 


Figure  3.  Example  of  Failure  Rates  Among  I'nilu-e  Mechanisms  Within  a System, 
a id  Identification  of  Those  That  Can  Be  Improved  Through  Testing 


CONTROL  OF  PESIC.N  FOR  RELIABILITY 

Control  of  the  design  during  development  requires  that  a measure  of  the  deviations  from  expected  or 
desired  be  available  to  furnish  the  feedback  for  corrective  actions,  jources  of  measured  deviations  include 
the  following,  among  others: 

a Quc  ntitative  design  analysis 
a Parts  quali'y  tests 
a Inspections 
a Burr.- in  tests 
a Performance  checks 
a Development  tests 

Too  frequently  the  information  derived  from  these  sources  is  not  used  to  control  reliability. 

To  control  reliability  achievement  in  the  R&D  phase  of  a system,  the  project  manager  must  know  how 
to  perform  three  essential  functions  within  the  framework  of  IPs  selected  management  approach 

(1)  Contractually  Specify  the  System  Reliability  Requirement.  He  must  know  how  to  specify  realistic 
quantitative  functional  perlormance  characteristics  and  design  requirements  for  reliability  relative 
to  these  performance  characteristics,  and  how  to  specify  demonstration  test  requirements  and 
acceptance  criteria  to  ensure  conformance  to  the  specified  requirements. 

(2)  Evaluate  Progress  Toward  the  Specified  Requirements.  He  must  know  how  to  evaluate  design  progress 
and  problem  status  relative  to  specified  system  reliability  requirements  at  designated  design- review 
and  critical  decision  points  during  the  development  phase,  and  he  * to  verify  the  lorrection  of  deficien- 
cies as  a prerequisite  to  making  a design  approval  decision. 

(3)  Verify  Conformance  to  the  Specified  Requirement.  He  must  know  hc.w  to  verify  conformance  to  the 
specified  reliability  requirements  and  how  o make  accept/reject  decisions  at  designated  major  mile- 
stones, on  the  basis  of  conformance  verification  test  results,  to  ensure  that  system  and  equipment 
designs  which  fail  to  demonstrate  conformance  to  specified  system  reliability  requirements  do  not 
emerge  from  his  progra.i. 

DEVELOPMENT  TES  HNC,  KEQE IREMENTS 

In  the  dps-ign  and  manufacture  of  avionics  equipment,  many  unknowns  and  intangibles  exist  that  cannot 
be  analytically  forecast  or  foreseen.  Extended  product  experience  in  the  intendeu-u.se  or  simulated  envi- 
ronment is  necessary  to  identify  the  family  of  hidden  failure  mechanisms  for  corrective  action  and  to 
validate  corrective  actions.  The  crux  of  reliability  p.  -.ning  today  is  the  ability  to  determine  the  amount 
of  product  experience  (evaluation  testing)  needed. 

The  criteria  for  a successful  development  which  satisfies  reliabili  y requirements  consist  of  the 
follow  Ing 

(1)  Inherent  reliability  as  measured  by  analysis  (M1L-HDHK-217)  must  exceed  the  requirement, 
t.  e,  , there  must  be  a reliability  design  margin. 

(2)  Reliability  growth  experience  must  Indicate  realistic  growth. 

(.1)  Time  for  achievement  must  be  available. 
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The  successful  program  man;  for  will  satisfy  tin.,*’  criteria  by  selecting  a design  through  simplification, 
reduced  parts  stress,  and  other  techniques  in  order  to  yield  an  inherent  capability  (MTHF)  at  least  12.')% 
of  the  required  MTHF.  making  .<  realistic  appraisal  of  the  nrw  design  (initial  reliability  may  be  only  10% 
of  the  inherent);  establishing  a strong,  disciplined  analysis  and  corrective  action  team,  and  establishing 
testing  schedules  which  recognize  that  growth  in  reliability  will  be  inversely  proportional  to  the  cumula- 
tive operating  (test)  time. 

The  amount  of  "effort"  required  to  achieve  a specified  MTHF  depends  on  three  items  --  the  so  .ied 
MTHF  (8p),  the  initial  MTHF  ( 8 \) , and  the  rate  (m)  at  which  tun  MTHF  can  be  increased,  as  illustrated 
in  Figure  4.  The  difference  between  the  inherent  reliability  which  represents  the  potential  reliability  for 
the  system  and  required  reliabilitv  is  the  design  margin. 

The  relationship  among  test  time,  the  growth  rate,  and  the  requirements  is-  give.,  by  the  following  * 
tm  * (1  - m)e0/6i 

where  time  is  expressed  in  standardized  units  of  ep  (the  potential  MTHF); 
m is  the  growth  rate; 

00  is  the  required  MTHF,  and 

0j  is  the  initial  MTHF  measured  frem  test  data. 

This  theoretical  relation,  which  has  been  confirmed  empirically,  reflects  ttie  relation  found  between 
cumulative  test  time  and  mean  time  between  failures.  This  expression  can  also  be  written  as 

tm  « (1  - mIKi/Ko 

whei  j Kj  * ftp/di  is  the  reliability  maturity  ratio,  and 
Kq  * flp/00  is  the  reliability  design  margin. 

Plotting  thio  relation  on  log-log  paper  results  in  a straight  line,  which  allows  simple  comparisons 
between  expected  and  observed.  The  growth  rate,  m,  has  been  determined  from  the  study  of  reliability 
growth  in  a variety  of  equipment;  these  determinations  are  shown  in  Table  2 along  with  typical  reliability 
maturity  ratios.  A large  value  for  m <m  » 0.5)  reflects  a hard-hitting,  aggressive  reliability  program 
with  management  support  spanning  all  functions  of  a knowledgeable  organization,  while  a low  value  of  m 
(m  < 0.  1)  reflects  the  growth  in  reliability  that  is  due  largely  to  the  need  to  resolve  obvious  problems 
that  impact  on  production,  and  to  corrective  action  resulting  from  user  experience  and  complaints.  We 
have  actually  observed  negative  values  in  certain  situations  where  engineering  changes  had  been  introduced 
to  improve  "performance",  at  risk  of  loss  in  reliability.  The  maximum  value  of  m that  could  be  expected 
is  probably  no  greater  than  0.  6 or  0.  7 because  of  the  time  lag  in  detecting  failure  mechanisms,  creating 
solutions,  ana  implementing  the  e gineering  changes.  Our  experience  during  development  testing  indicates 
that  realistic  values  of  m are  In  the  0.  35  to  0.  50  range. 


TEST  TIME 

Figure  4.  Relationships  Among  Specified  MTHF  (0g), 
Intti  1 MTHF  ((?[),  and  Growth  Rate  (m) 


J,  T.  Deane,  "beaming  Curve  Approach  to  Reliability  Monitoring."  tKEE  Transactions  Aerospace, 
Vol.  2,  March  1974. 

G.  Ronald  Herd,  "The  Relation  Hetwecn  Test  Time  and  MTHF’  Cnder  a Changing  System  Failure 
Rate  During  System  Testing,"  Bird  Engineering-Research  Associates,  Inc.,  1975. 


Table  2.  Sample  of  Test  Parameters  Observed  in  Actual  Test 
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Observed  Values 

Equipment/System  Function 

Complexity 

(AEGs) 

Test  Conditions 
or  Life  Cycle  Phase 

Maturity 

Ratios, 

Growth 

Rates, 

m 

l,ow  Power  Electronic  Units 

■ 

Analog  (receivers,  amplifiers,  etc.) 

2 00 -U JO 

Contractor  Development  Test 

6 

BBS 

Analog  Computer 

400-600 

Fleet  Operational  (ORDALT) 

15 

K82S 

Digital  Computer 

High  Power  Electronic  Units 

3000-6000 

Contractor  Develooment  Test 

4 

0.48 

200-1000 

Contractor  Development  Test 

10 

0.  30 

50 

Vendor  Life  1 • st 

10 

0.65 

Pulse  Transmitter  (new) 

1000-1 ^00 

Contractor  Development  Test 

20 

0.  35 

Pulse  Transmitter  (old) 

1000-  1500 

Fleet  Operational  (ORDALT) 

35 

0.  30 

Continuous  V v e (CWI) 

400-6CO 

Contractor  Development  Test 

15 

0.  35 

Using  the  relation  discussed  above,  we  can  now  determine,  for  planning  purposes,  the  testing  time 
required  to  achieve  the  reliability  requirement.  A nomograph, * shown  in  Figure  5,  has  been  developed  to 
simplify  the  determination  of  expected  test  time  required,  given  the  reliability  design  margin  (Kg  * 0d/8q), 
the  reliability  maturity  ratio  (Kj  * ftp / © j) , and  the  growl!'  rate  (m). 

Assume,  for  example,  a contractor  enters  the  development  phase  with  an  equipment  design  whose  pre- 
dicted MTBF  was  determined  to  be  ftp  * 100  hours  based  on  Mil  -HDBK-217  failure-rate  stress  analysis. 
Also  assume  the  specified  MTBF  requirement  for  the  equipment  had  been  established  at  0O  * 60  houri. 
These  two  values  yield  a reliability  design  margin  of  Kq  * flp/0 q * 100/80  * 1.25  . If,  after  the  first  11.0 
hours  of  development  testing  (i.  e. , at  t j * 1 x ftp  • loo  hours),  ten  critical  and  major  failures  had  been 
observed  (i.e.,  rj  * 10),  then  the  in'.tial  MTBF,  ftj  * tj/r  » 100/10  is  10  hours.  From  this,  the  reliabiL.y 
maturity  ratio,  Kj  « ftp  / ft  j , is  determined  to  be  10.  The  development  test  program  will  require  between 
1,600  hours  (for  m * 0.5)  to  31,000  hours  (for  m « 0.3),  depending  or  the  contractor's  effectiveness  i 
Identifying  and  correcting  failures  during  the  test. 

The  following  guidelines  can  minimize  the  amount  of  development  testing  required  to  achieve  a speci- 
fied value  of  MTBF: 

(1)  Provide  an  MTBF  Design  Margin.  Achieve  a design  goal  MTBF  (as  verified  by  prediction  analysis) 
well  above  the  specified  MTBF.  A reliability  design  margin  (between  specified  requirement  and  the 
Inherent  predicted  goal)  of  between  25%  and  50%  (i.e.,  Kp  ■ 1.25  to  1.5)  should  be  sought. 

(2)  Perform  Design  Review  and  Configuration  Analysis  Prior  to  Itelease  to  Development.  Verify  adequacy 
of  the  item  (e.g.  , equipment)  to  be  submitted  for  development  testing  to  verify  compatibility  of  stress 
ratings  and  tolerances,  quality  of  parts  and  materials,  quality  of  workmanship,  etc.  This  helps  to 
reduce  the  reliability  maturity  ratio,  Kj  * ftp/ftj,  which  is  measured  during  development  testing. 

(3)  Assign  and  Follow  Up  on  Corrective  Action.  Require  that  all  failures  observed  during  development 
testing  are  full;  described,  recorded,  diagnosed,  and  formally  assigned  (or  corrective  action.  Then 
systematically  follow  up  and  verify  completion  of  each  corrective  action  assignment.  The  goal  is  to 
achieve  an  MTBF  growth  rate  to  approach  (or  exceed)  m ■ 0.5. 

The  grid  in  the  center  of  the  nomograph  shown  in  Figure  5 combines  the  two  experience  variables 
(Ki  and  m)  through  which  Kq  and  T0  are  related.  Both  values  of  Kj  and  m must  be  established  c.n  the 
basis  of  previous  test  exper.ence;  or,  In  the  absence  of  experience,  a conservative  estimate  can  be  derived 
from  other  closely  related  test  experience,  as  tabulated  in  Table  2. 


* George  T.  Bird,  "Development  Testing  Requirements  To  Achieve  Reliability  Requirements," 

Bird  Engineering-Research  Associates,  Inc.,  197;.  Also  published  in  Rei'abillty  Guides,  NAVORD  Ol) 
44622,  Vol.  I,  Naval  Sea  Systems  Command,  1078. 


Two  cases  are  used  to  illustrate  use  of  the  nomograph 

■ Case  A --  an  equipment  whose  design  MTHF  margin  was  zero  (e,  g.  . Kq  » 1.0),  with  a high 
reliability  maturity  ratio  indicating  inadequate  design  and  configuration  review  prior  to  release 
to  development  (e.  g.  , K|  * 15),  and  in  which  development  testing  proceeded  without  a strong 
reliability  assurance  (follow-up)  program  (e.  g.  , m - 0.  3). 

■ Case  1)  - -an  equipment  with  50%  design  MTlii'  margin  (e.  g.  , Kq  » 1.5),  an  adequate  final  design 
configuration  review  prior  to  release  to  development  (e.g..  Kj  * 5),  and  an  effective  reliability 
assurance  program  throughout  development  (e.  g.  , m « 0.  5). 

Assume  tiiat  both  Case  A and  Case  H had  been  lesigned  to  satisfy  the  same  specified  MTHF  ■ 100-hour 
requirement.  Case  A will  require  approximately  25,000  hours  of  development  testing  to  achieve  the 
specified  MTHF.  In  contrast,  Case  f)  will  require  aj  pi  oximatelv  300  hours  of  testing  to  achieve  the 
same  requirement.  The  range  in  test  time  (between  Cases  A and  H)  shown  in  Figure  5 closely  corres- 
ponds to  the  test  experience  over  many  test  programs. 

The  effect  of  a high  reliability  design  margin  on  the  expected  development  test  time  is  illustrated  in 
Table  J.  Increasing  the  margin  by  20%  (from  1 . 25  to  1 . 50)  reduces  the  expected  test  time  bv  36.  6%.  as 
indicated  in  the  table,  and  an  increase  of  40%  (from  1.25  to  1.75)  yields  a reduction  of  56.  8%  in  expected 
test  time.  Doubling  the  margin  (from  1.25  to  ..50)  reduces  tes  time  by  82.4%. 


/ 
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Table  5.  Development  Test  Time  for  a Typical 
Situation  for  an  Avionics  Equipment 
( 0p / 0 1 * 10.  m » 0.4) 


Reliability 
Design  Margin 

Op/Oo 

Expected  Development 
Test  Time 

t * 1(1  - m>e0/ei],/rn 

1.00 

88.2  x 8P 

1.25 

50. 5 x 8p 

1.50 

32.0  x 8p 

1.  75 

21.8  x 8p 

2.00 

15.6  x 6p 

2.  50 

8.9  x 8p 

MONITORING  RELIABILITY  DURING  DEVELOPMENT  TESTING 

The  relation  among  failures  (critical  and  major),  test  time,  initial  value  of  ob  erved  MTBF,  and  ti  e 
effectiveness  of  the  contractor's  reliability  assurance  program  was  presented  earlier.  These  measures 
can  be  combined  to  provide  a graphical  method  for  monitoring  reliability  status  throughout  the  develop- 
ment test  program  and  provide. 

■ Current  status  of  MTBF  relative  to  established  milestone  criteria, 
a MTBF  growth  rate. 

a Test  time  required  to  achieve  the  specified  MTBF. 

a An  estimate  of  the  MTBF  that  will  be  achieved  at  the  end  of  the  curmtly  planned  test  program. 

Experience,  covering  many  test  programs,  has  revealed  a relation  between  the  (logarithm  of  the 
cumulative  test  time  and  the  (logarithm  of  the)  cumulative  number  of  failures  when  corrective  actions 
are  taken  to  eliminate  failure  modes. 

There  are  four  ways  we  may  monitor  the  information  that  is  generated  during  a test  program;  each 
involves  presenting  the  number  of  failures  or  some  function  thereof  against  the  cumulative  test  time. 

The  four  measurements,  illustrated  in  Figure  6,  are: 

■ Cumulative  number  of  failures, 

• Cumulative  MTBF. 

• MTBF  achieved  at  a particular  point  in  time,  the  instantaneous  MTBF, 

• MTBF  during  the  last  k time  units,  moving  average  MTBF. 

To  develop  the  expected  values  againjt  which  progress  will  be  measured  and  to  establish  the  test 
program  duration  requirement,  we  return  to  the  relation: 

tm  * (1  - m)80/8l 

Fri  m this  relation,  we  can  determine  the  expected  growth  in  reliability  and  thereby  the  standards  against 
whi  h the  four  measurements  identified  above  are  compared. 

Cumulative  Number  of  Failures 


The  cumulative  number  of  failures  expected  during  the  accumulation  of  test  time  is  given  by 
r • r,t(1-rn) 

where  r is  the  number  of  failures  observed  during  development  testing; 
t is  the  test  time  expressed  in  8p't  (inherent  MTBF); 
m is  the  measure  of  growth  in  reliability;  and 

rj  is  the  number  of  failures  observed  during  the  first  Op  hours  of  development  testing. 

The  value  of  m and  rj  should  reflect  the  developer's  own  experience,  but  if  that  is  not  known,  typical 
values  of  m * 0.4  and  rj  • 10  may  ue  used  to  establish  growth  objectives  so  that  the  expected  number  is 
r * lot0,6.  Updating  ot  rj  can  be  accomplished  at  the  end  of  8p  test  hours.  Thus,  the  comparison  of 
achievement  against  expectation  can  be  monitored  by  plotting  the  number  of  failures  against  the  total  test 
time  on  log- log  paper  as  illustrated  by  Curve  1 on  Figure  6. 


Figure  6.  Four  Ways  of  Presenting  Failure  Data  for  Reliability  Monitoring 
Cumulative  MTBF 


The  cumulative  MTBF,  illustrated  as  Curve  2 of  Figure  6,  is  the  cumulative  time,  t,  divided  by  the 
cumulative  number  o'  failures,  r;  a'd  using  the  above  expression  for  r,  then  expected  cumulative  MTBF 
can  be  written  as: 

0C  « 0 jtm 

where  t is  the  development  test  time; 

m is  the  reliability  growth  rate,  and 

01  is  the  MTBF  observed  during  the  first  unit  (0p  hours)  of  testing  time. 

The  value  of  m and  0]  used  to  establish  the  program  objectives  should  reflect  the  contractor's  own  exper- 
ience, howe”er  industry  experience  can  be  used  with  m • 0.  4 and  0)  ■ 0p/ 10  so  the  MTBF  to  be  expected 
during  development  testing  is  given  by  6C  * (9p/10)t°-4.  This  expected  cumulative  MTBF  can  be  plotted 
on  log-log  paper  as  a straight  line  (see  Curve  2 of  Figure  6).  By  plotting  the  observed  MTBF  (t  / r > as  the 
development  testing  progresses,  a comparison  may  be  made  between  the  objective  and  actual  achievement. 

Instantaneous  MTBF 


With  corrective  actions  changing  the  MTBF  of  the  system  during  development  testing,  the  cumulative 
MTBF  will  be  Influenced  by  the  "lower"  MTIlFs  attained  during  the  early  test  period.  To  determine  the 
achievement  in  MTBF  at  a particular  point  in  test  time,  the  derivative  of  the  cumulative  MTBF  --  toe 
instantaneous  MTBF  --  should  be  monitored.  The  instantaneous  MTBF  ran  be  shown  to  be  0[  * 0C  '(1  - m), 
and  we  ran  plot  the  expected  instantaneous  MTBF  when  0C  and  m are  known.  Since  it  is  not  poss.ble  to 
observe  the  instantaneous  MTBF,  we  can  only  approximate  it  by  observing  the  MTBF  over  the  last  unit  of 
test  time  (Sp  hours).  The  expected  Instantaneous  MTBF  can  be  plotted  also  on  log-log  paper  for  ease  in 
comparison,  as  shown  by  Curve  3 of  Figure  6.  The  observed  MTBF  during  the  last  unit  of  test  time  can 
then  be  plotted  for  control  purposes. 


1-10 


The  observed  MTBF  for  the  last  unit  of  test  time  will  be  based  upon  few  failures;  and  as  the  attained 
MTBF  approaches  the  required  MTBF  (6q),  the  variability  in  observed  value  will  increase  and  it  may 
become  difficult  to  interpret  or  determine  the  true  achievement. 


MTBF  During  Last  k Time  Units  (Moving  Average  MTBF) 

Since  the  "observed  instantaneous"  MTBF  is  highly  variable,  particularly  when  the  actual  attained 
MTBF  approaches  the  requited  MTBF,  it  is  advantageous  to  use  a longer  test  period  to  establish  the 
attained  MTBF  and  still  be  more  indicative  of  the  achieved  status  than  the  cumulative  MTBF.  Therefore, 
for  monitoring  purposes,  we  can  use  the  last  k units  of  test  time  to  determine  th'i  MTBF;  and,  for  a 
fixed  k,  the  base  period  of  test  time  continually  moves  as  the  test  time  progresses,  yielding  a moving 
average.  The  expected  "moving  average"  MTBF  is  given  by: 

5„ . ,,,« r — fisfii — ] . ,c  r — m — ] 

[l  - (1  - ,i/t)1'mJ  [l  - (1  - k/t)l'mj 

where  0i  * flp/10  and  m * 0.4,  based  upon  industry  experience;  it  is  plotted  for  k * 5 in  Curve  4 of 
Figure  6.  It  can  be  shown  that  TTg  approaches  the  instantaneous  MTBF  rs  t-^oc  (since  k is  fixed). 


To  monitor  progress  then,  we  can  compute  the  MTBF  for  the  last  k units  of  time  and  plot  this  against 
total  test  time  on  log- log  paper  for  a simple  comparison  between  expected  and  actual  achievement. 

Example 

Now  we  can  utilize  the  information  presented  above  in  the  following  example  of  development  testing 
results.  In  this  example,  engineering  changes  were  made  during  testing  wherever  failure  mechanisms 
were  identified  and  solutions  established.  The  system  under  test  had  an  inherent  MTBF  of  I JO  hours  and 
the  re  ,uired  MTBF  was  80  hours.  Prior  to  the  start  of  development  testing,  the  expected  growth  and 
required  test  time  were  established  based  upon  industry  experience  that  the  initial  MTBF  would  be  10% 
of  the  inherent  MTBF  and  that  growth  rate  in  reliability  would  yield  an  m * 0.4.  Table  4 presents  the 
actual  observed  values  determined  from  the  test  results,  and  these  data  are  shown  in  Figure  7 plotted 
against  the  expected  values  established  in  advance  of  testing.  Comparison  of  actual  against  expected 
results  as  shown  in  the  figure  furnishes  the  monitoring  capability  for  reliability  control. 


Table  4.  MTBF  Calculations  as  Failures  Occur  in  Development  Testing 
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RELIABILITY  GROWTH  HODELLINC  FOR  AVIONICS 

by 

J.E.  Green 

Royal  Radar  EatabI iahment 
Creat  Malvern,  U.K. 


SUMMARY 


The  factors  which  influence  Che  reliability  of  avionica  are  reviewed, 
with  emphasis  on  the  development  phase.  Reliability  growth  modelling  is 
increasirqly  being  recogni.  'd  as  a realistic  technique  for  management  to  use 
in  project  planning,  and  a ethod  for  providing  progressive  estimates  of 
reliability  achievement  du  ,ng  the  development  phase.  Reference  is  made  to 
the  use  of  computer  programmes  for  th.se  purposes,  and  for  estimating  costs. 

The  validity  of  the  Duane  Model  is  considered  against  practical  exper- 
ience gained  during  development  of  military  avionics.  Explanations  are 
given  for  observed  deviations  in  the  short  and  long  term  periods,  and  the 
need  to  make  adjustments  for  different  environmental  stress  conditions  is 
noted.  Further  verificatio-  of  a mathematical  law  for  the  rate  of  appear- 
ance of  types  of  systemaci'-  pattern)  failures  is  reported. 

The  paper  concludes  ' :h  a review  of  potential  avionic  reliability  as 
more  microelectronics  are  ed,  and  considers  the  eventual  limiting  factors. 


INTRODUCTION 

The  interest  in  reliability  growth  modelling  for  avionics  really  began  in  1968  when  Codier  presented 
a paper  at  the  IEEE  Annuel  Symposium  on  Reliability*.  and  drew  attention  to  an  empirical  model  which 
J.T.  Duane  had  proposed  six  years  earlier  in  a Ceneral  Electric  Technical  Report  - See  Appendix  1. 

The  original  data  had  been  derived  from  test  experience  with  complex  aircraft  generators,  hydro- 
mechanical devices  and  a jet  engine  - see  Fig  1.  Duane  had  observed  that  for  test  programmes  in  which  a 
sustained  effort  was  maintained  to  introduce  improvements  following  experience  of  failure,  there  was  a 
mathematical  relationship  between  overall  failure  rate  counting  all  failures,  and  total  operating  time, 
such  that  plots  on  log-log  paper  lay  approximately  on  a straight  line.  Codier  reported  the  same  law  for 
data  obtained  during  the  development  of  an  airborne  radar.  Then  in  1970  Selby  and  Miller  of  the  same 
company  presented  their  well  known  paper^  in  which  Duane's  Model  was  shown  to  apply  equally  well  for 
several  avionic  equipments. 

The  increasing  current  interest  stems  mainly  from  the  facility  of  providing  management  with  prog- 
ressive estimates  of  reliability  achievement  based  on  actual  operating  experience  and  an  indication  of  the 
prospects  of  eventually  meeting  the  reliability  target  within  the  allotted  resources.  The  real  merit  of 
this  modelling  approach  is  that  it  requires  a planned  and  disciplined  test  program*  aimed  at  searching 
out  the  weaknesses  in  a new  equipment.  The  prcgracme  does  not  diminish  the  responsibility  of  the  designer 
in  any  way.  \ 

The  increasing  emphasis  on  reliability  stems  from  the  very  high  cost  of  procuring  and  operating  modern 

military  aircraft.  Any  successful  sortie  is  now  more  de  ident  than  eve  before  on  the  reliability  of 

highly  complex  avionics.  The  costs  attributable  to  the  maintenance  and  tupport  organisation  on  account  of 
unreliability  are  alarmingly  high.  In  the  1971  AGARD  Lecture  Scries  it  a as  stated  by  Baker^  that  the 
aircraft  operating  and  maintenance  costs  over  a ten  year  li*’  -•*- were  typically  three  times  the  initial 
cost.  The  remarkable  advances  in  electronics  technology  have  meant  that  each  generation  of  aircraft  has 
been  fitted  with  radically  different  and  more  sophisticated  equipment,  and  in  much  greater  quantity.  The 
reliability  of  the  circuit  elements  has  probably  increased  by  at  least  an  order  over  the  last  fifteen  years, 
but  there  has  been  r,o  corresponding  reduction  in  the  contribution  of  avionics  to  the  unrelisbility  of  the 
total  aircraft  system. 

It  is  only  fair  to  point  out  that  there  has  been  some  opposition  to  the  Duane  Model.  Some  don’t  care 
for  the  empirical  nature  of  the  model,  some  fear  the  possibility  that  the  reliability  estimates  might  be 
accepted  in  lieu  of  a formal  compliance  test  at  the  end  of  development  or  in  production.  This  paper  will 

consider  experience  including  anomalies  that  have  been  observed,  in  order  to  promote  further  discussion  on 

the  subject. 


FACTORS  INFLUENCING  RELIABILITY 

In  order  to  complete  the  setting  of  the  scene.  Table  1 lists  the  more  important  of  the  many  factors 
that  influence  the  reliability  of  military  avionics. 


/ 


/ 

/ 


1.  Requirement  of  highest  performance  for  military  advantage,  often 
reaulting  in  complexity 

2.  Quality  of  deaign 

3.  Uae  of  lateat  component*  and  constructional  technique* 

4.  The  aircraft  factors;  type  of  aircraft,  installation,  sortie 
duration,  adverse  operational  environments 

5.  Resource*  allocated  for  development;  timescale  and  i ney 

6.  Contractor  awareness  of  reliability  engineering 

7.  Number  of  development  models 

8.  Total  operating  time  during  development 

9.  Intensity  of  monitoring  performance,  investigating  deficiencies  and 
taking  corrective  actions 

10.  Quality  control  in  manufacture,  including  burr.-in 

11.  Training  of  Services  personnel 

12.  Maintenance  standards  and  test  facilities 


TABLI  1 

It  might  be  claimed  that  good  management  should  take  care  of  all  these  factors,  however  at  the  start 
of  a project  almost  everyone  is  optimistic.  There  is  a readiness  to  believe  that  the  anticipated  potential 
problems  will  be  solved  end  that  the  latest  laboratory  discoveries  can  be  perfected  and  turned  into  a 
production  item  despite  any  constraints  of  time  and  money.  Experience  shows  that  many  of  the  weaknesses 
that  eventually  cause  unreliability  in  service  have  often  not  been  foreseen,  and  have  not  been  experienced 
during  the  development  phase.  It  follows  therefori  that  quality  of  decign  must  be  given  greater  attention, 
and  that  there  must  be  an  extensive  reliability  teat  programme  during  development  in  order  to  discover  the 
latent  weaknesses. 

It  is  most  important  to  staff  the  test  activity  with  engineers  who  nave  had  design  experience,  and 
to  provide  comprehensive  test  equipment  with  which  they  can  monitor  performance  in  depth.  It  is  also 
important  to  have  a data  collection  centre  and  to  ensure  that  ever  indication  of  weakness  in  every  devel- 
opment equipment  is  reported.  The  data  centre,  staffed  by  reliability  engineers,  is  responsible  for 
ensuring  that  every  report  is  referred  back  to  the  appropriate  department  and  that  thr  agreed  decision  on 
follow-up  action  is  recorded  and  implemented. 


U.K.  EXPERIENCE  OF  RELIABILITY  GROWTH  MODELLING 

1 was  in  the  audience  at  Boston  when  Codier  read  his  paper  and  my  interest  was  aroused.  On  returning 
to  the  U.K.  a retrospective  anslysis  was  carried  out  on  data  from  the  development  programme  for  an  airborne 
radar,  and  it  was  found  that  the  plots  fitted  well  to  Duane's  Model  - see  Fig  2.  In  this  graph  cumulative 
MTBF  has  been  plotted  instead  of  cumulative  failure  rate.  It  she.  how  the  attained  or  "instantaneous" 
MTBF,  that  is  the  MTEF  which  should  be  exhibited  if  no  further  modifications  were  introduced,  is  obtained 

by  simply  multiplying  the  cumulative  observed  MTBF  by  y , where  a is  the  tangent  of  the  angle  on  the 

log-log  paper.  Plots  of  the  attained  MTBF  will  lie  on  a parallel  line  as  shown,  and  by  extending  this 
line  a prediction  can  be  made  of  the  further  improvement  that  should  be  realised  as  the  test  and  modific- 
ation procedure  continues.  In  this  case  a further  800  hr  of  severe  environmental  test  should  result  in 
the  incorporation  of  improvements  which  will  raise  the  MTBF  from  61  to  70  hr. 

At  this  point  it  is  worth  noting  that  occasionally  there  is  a misunderstanding  about  the  parameter  a, 
which  has  always  been  called  the  "growth  rate"  :n  Duane  terminology.  This  is  a misnomer  and  "growth 
slope"  might  have  been  more  appropriate.  Since  a tends  to  be  constant,  some  think  at  first  sight  thst  the 
rate  of  improvement  of  MTBF  will  remain  constant  as  more  operating  hour*  are  accumulated.  This  is  not  so, 

and  the  rate  of  increase  of  MTBF  is  actually  proportional  to  (operating  time)0  *,  therefore  it  diminishes 
with  increasing  time  - See  Appendix  Eq.  (6). 

Data  from  two  more  U.K.  projects  showed  reasonable  agreement  with  Duane’s  Model,  with  "growth  rstes” 
of  0.4  and  0.5  approximately,  the  latter  reflecting  advanced  new  technology.  Fig.  3 shows  dsta  for  two 
development  models  of  an  airborne  radar  operated  simultaneously  in  a severe  test  environment.  The  oper- 
ating hours  and  number  of  failure  have  been  totrlled.  The  growth  rate  a after  2800  hr  was  0.41,  which 
was  close  to  the  figure  of  0.4  that  had  been  anticipated  initially  after  an  assessment  of  the  technical 
difficulties  involved  in  the  project,  and  previous  experience  with  the  same  contractor.  The  early  relia- 
bility standard  was  slightly  below  that  predicted,  but  in  general  the  reliability  growth  plot  showed  good 
agreement  to  the  path  that  was  predicted  in  1972,  up  to  about  3000  hr.  Over  the  last  2000  hr  the  plots 
have  deviated  from  the  previous  straight  lire,  reducing  o slightly  to  0,38  and  causing  a deviation  ir  the 
line  for  the  attained  KTgp^  which  has  reached  100  hr  compared  with  the  120  hr  target.  However  it  is 
thought  that  this  estimate  is  somewhat  pessimistic  because  a number  of  repetitive  failures  have  been 
included,  and  this  problem  with  Duane  estimates  will  be  referred  to  again  later. 

Practical  aspects  of  a reliability  growth  programme  will  now  be  considered  in  three  periods,  the 
early  time  period  of  thr  first  few  hundred  hours,  the  middle  period,  and  the  later  period  after  several 
thousand  hours. 


/. 
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The  Early  Tima  Period 


After  in  equipment  ie  first  assembled,  it  has  to  go  through  a period  of  operation  in  order  to  identify 
and  eliminate  any  manufacturing  errors  and  to  confirm  that  it  is  working  satisfactorily.  The  equipment  is 
then  passed  to  the  reliability  test  section,  where  it  is  operated  typically  for  a further  SO  hr  at  room 
ambient,  followed  by  e further  3o  hr  during  which  separate  tests  ere  carried  out  under  vibration,  and  at 
high  and  low  temperatures.  This  is  a familiarisation  exercise  for  teat  procedures,  a burn-in  process,  and 
an  expeditious  procedure  for  clearing  the  more  obvious  deficiencies  associated  with  exposure  to  one  partic- 
ular environment.  The  equipment  is  then  considered  ready  to  start  the  accounted  reliability  growth  prog- 
rassae.  It  will  have  operated  for  about  100  hr  in  all  since  assembly. 

the  first  Duane  plot  is  made  after  a further  100  hr  operation.  This  is  the  same  convention  as  that 

adopted  by  Selby  and  Hiller2.  In  the  early  accounting  period  the  plots  tend  to  be  somewhat  erratic,  but 

as  testing  continues  and  isgirovements  are  introduced  they  become  orderly  and  the  familiar  straight  line 

on  loq-log  paper  begins  to  appear.  In  our  experience  if  the  line  it  extrapolated  back  it  intersects  the 
100  hr  exit  in  the  region  of  15Z  of  the  predicted  MTBF.  Selby  and  Miller  reported  10Z,  and  the  range 
10-20Z  appears  to  cover  nearly  all  known  cases. 

With  the  first  development  models  on  a new  project,  another  trend  has  been  observed  when  plotting 
Duane  charts,  as  shown  in  Fig.  4.  The  dip  it  associated  with  the  phase  when  an  increasing  proportion  of 
the  operating  time  is  under  a severe  test  environment.  This  observation  leads  to  some  important  practical 
considerations.  Firstly,  when  investigating  the  cause  of  a failure  which  hat  occurred  at  low  or  high 
tesg>erature,  the  engineers  often  have  to  operate  the  equipment  experimentally  at  room  temperature,  and 
'ometimet  the  investigation  may  be  prolonged.  If  further  failures  occur,  perhaps  unrelated  to  the  one 
under  investigation,  these  have  to  be  counted  in  the  cumulative  total,  Bui  if  the  environmental  stiess 
level  is  low,  the  failure  rate  should  be  lower  than  that  when  the  equipment  is  subjected  to  a severe  test 
condition.  It  seems  logical  to  propose  that  operating  time  should  be  normalised  to  a standard  environ- 
mental stress  level.  This  will  largely  eliminate  the  dip  in  the  graph  sh.wn  in  Fig.  4,  Another  factor 
although  minor  which  contributes  to  the  dip  is  that  delays  sometimes  a"'.  ..t  before  a modification  is 
finally  decided.  There  is  pressure  to  keep  up  with  the  schedule  for  accumulation  of  operating  hours,  and 
incorporation  of  modifications  is  often  delayed  jntil  the  test  is  stopped  by  some  other  event.  Thus  there 
is  a reaction  time  before  the  effect  of  corrective  actions  begins  to  show  on  reliability  growth.  This  is 
particularly  so  in  the  early  time  period  when  the  failure  incidence  is  higher.  Duane  assumed  that  any 
modifications  would  be  introduced  promptly. 

The  Middle  Time  Period 


For  the  major  middle  time  period  from  a few  hundred  out  to  several  thousand  hours  the  Duane  Model 
fits  well  in  our  limited  experience,  and  is  most  useful  in  providing  practical  quantitative  evidence  to 
sumagement  on  the  rate  of  progress  towards  meeting  the  reliability  requirement. 

Two  points  are  worth  noting.  The  first  is  that  there  has  been  some  evidence  that  reliability  is 
influenced  by  the  rate  of  accumulation  of  operating  hours.  Higher  reliability  appears  to  be  associated 
with  faster  accumulation  of  operating  hours  in  a given  calendar  period.  The  evidence  tends  to  be  masked 
by  the  smoothing  effect  of  cumulative  plots.  One  explanation  could  be  the  presence  of  a non-operating 
failure  rate.  The  second  point  is  that  failure  incidents  tend  to  bunch  together. 

The  Later  Time  Period 


In  the  later  time  period  after  several  thousand  hours  of  operation,  plots  usually  begin  to  deviate 
below  the  extrapolation  of  the  previous  straight  line,  indicating  that  the  "growth  rite"  i is  beginning  to 
decrease.  As  an  illustration,  in  the  case  of  the  result'  for  the  airborne  radar  project  shown  in  Fig  ], 
the  deviation  was  partly  due  to  repetitive  failures  caused  by  two  very  difficult  problems  which  persisted 
until  nearl"  the  end  of  the  test  progranme.  In  such  cases  estimates  of  attained  MTBF  tend  to  be  low 
because  both  cumulative  MTBF  and  a are  reduced.  Some  adjustment  in  the  number  of  failures  may  be  con- 
sidered when  there  is  no  doubt  that  the  problem  has  been  overcome. 

It  is  suspected  that  some  latent  secondary  failures  occur,  that  is  failure  of  components  which 
were  subjected  to  overstress  when  earlier  equipment  failures  occurred,  sufficient  to  cause  some  damage  but 
not  to  show  up  as  an  equipment  malfunction.  For  example,  suppose  a semiconductor  device  fails  after  2000 
hr  of  severe  environmental  testing  for  no  apparent  reason.  It  may  be  difficult  if  not  impossible  to  prove 
that  it  had  been  subjected  to  an  electrical  overstress.  It  might  have  been  a sub-standard  component 
initially,  but  bum-in  plus  2000  hr  seems  a long  time  to  nave  functioned  without  any  indication  of  trouble. 
The  risk  of  secondary  damage  must  be  a possibility. 

Practical  experience  does  suggest  that  the  Duane  graph  will  tend  to  flatten  out  eventually  for 
complex  avionics  because  of  the  persistence  of  some  failures  which  are  related  to  technical  difficulty, 
also  our  inability  to  ensure  100Z  quality  in  components  and  construction,  and  the  occasional  cases  of 
accidental  overatress.  A good  example  is  the  high  voltage  transmitter  and  associated  power  supplies  of  an 
airborne  radar.  Bezat  et  al4  also  observed  this  deviation  in  the  plots  during  the  later  time  period,  and 
in  order  to  overcome  the  difficulty  proposed  that  a random  failure  rate  term  should  be  added  to  the  Duane 
equation. 


THE  EXPONENTIAL  LAW  FOR  SYSTEMATIC  FAILURES 


N.B.  Systematic  failures  are  equivalent  to  pattern  failures  and  are  repetitive  or  by  nature  likely  to  be 
repetitive.  They  are  identified  as  due  to  design  or  manufacturing  weaknesses  and  are  capable  of  bring 
demonstrated  by  intent. 

An  empirical  law  for  the  rate  of  appearance  of  types  of  systematic  failure  was  reported  in  my  joint 
paper  with  Mr  P.H.  Mead  at  the  1969  IEE  Reliability  Synyosium5  - see  Fig  5 For  several  build  standards 
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of  a complex  airborne  radar,  aubjected  to  a fairly  aevere  environmental  teat  cycle  (-26/*70°C  cycling, 
with  extensive  swept  frequency  vibration  10-200  Ha  at  l.7g),  the  following  law  was  discovered:- 


F 

tso 


Ft,p  (1  - 


where  F • number  of  types  of  systematic  failure  observed  in  t operating  hours. 


The  400  figure  is  an  empirical  time  constant  for  the  stated  environmental  test  conditions.  For  less  severe 
conditions  it  should  increase,  and  conversely  decrease  for  more  severe  conditions,  in  the  limit  tending  to 
zero  for  a high  overstress  accelerated  test  condition.  Experience  indicates  that  the  figure  of  400  applies 
consistently  for  the  typical  thermal  cycling  tests  with  vibration  that  are  used  in  the  development  phase 
for  military  avionics.  The  formula  indicates  that  over  SOZ  of  the  types  of  systematic  failure  present  in 
any  sample  equipment  will  be  revealed  in  approximately  1000  hr  ie  (l  . It  is  necessary  to 

continue  for  a further  period  of  time  to  confirm  that  modi f icationp  arc  satisfactory,  but  in  general  it 
appears  that  1500-2000  hr  mi  g..t  be*  a practical  limit  for  each  model  unless  the  target  MTBF  is  at  least 
several  hundred  hours,  or  there  is  a case  for  observing  long  term  wearout  failures.  It  is  more  rewarding 
and  in  most  cases  more  cost  effective  to  coranence  tests  on  a new  equipment  of  improved  build  standard. 


More  information  about  the  ultimate  limitations  of  the  otherwise  discarded  models  could  be  obtained 
by  carrying  on  with  a deliberate  overstressing  programme.  The  overstressing  could  be  either  thermal  or 
mechanical  or  electrical,  and  would  require  close  collaboration  with  the  designers  in  order  to  provide  the 
most  useful  information.  The  time  constant  would  then  be  less  than  400. 


Now  from  the  mathematical  aspect  this  exponential  law  is  not  compatible  with  Luane's  Model.  By 
differentiating,  it  is  apparent  that  log  of  failure  rate  will  be  proportional  to  time,  and  not  log  time. 

It  follows  that  if  the  Duane  plots  lie  on  a straight  line  on  log-log  scales,  there  must  be  additional 
failures  to  those  classified  as  Types  of  Systematic,  and  these  are:- 

a)  Repetitive  systematic  failures  where  the  complete  cure  has  not  been  found. 

b)  The  so-called  random  failures  where  the  cause  cannot  be  traced;  these  include  possible  latent 
secondary  failures. 

c)  Long  term  failures  identified  as  due  to  quality  control  lapses  eg  Sub-standard  components  and 
poor  assembly. 

d)  Wear-out  failures  eg  Magnetrons. 

It  is  most  interesting  that  the  numbers  add  up  to  give  a good  fit  on  the  log-log  Duane  Plot  while 
the  rate  of  appearance  of  Types  of  Systematic  Failure  consistently  fit  the  exponential  law. 

Fig  6 shows  data  for  an  early  development  radar  on  a current  project.  It  should  be  explained  that 
our  policy  is  to  record  every  observation  that  might  indicate  a deficiency  in  the  new  equipment,  and  to 
check  that  corrective  action  ia  taken  whenever  possible.  Every  event  is  classified  according  to  the 
effect  it  would  have  had  in  ope  ational  use  of  the  equipment,  for  example  whether  it  would  have  caused  a 
mission  failure,  or  whether  it  would  have  necessitated  unscheduled  maintenance  when  the  aircraft  returned 
to  base.  In  less  than  10Z  of  the  events  is  there  any  doubt  about  classification.  The  graphs  snow  that  63 
types  of  systematic  detect  were  observed  on  the  radar  and  that  30  types  would  have  caused  an  aircraft 
mission  failure.  The  figures  are  related  to  the  quality  of  design,  the  technical  difficulty  and  the 
manufacturing  standards.  The  defect/nission  failure  ratio  is  useful  advance  information  tor  the  Services 
about  the  new  radar. 


This  exponential  law  seems  to  apply  consistently,  and  for  different  categories  of  events.  It  has 
also  ’ er-*  observed  that  at  least  two-thirds  and  sometimes  four-fifths  of  the  deficiencies  found  during 
devlopment  or  in  service  use  cannot  be  identified  at  the  st£ge  when  the  first  hardware  is  assembled. 

These  weaknesses  are  not  foreseen  by  anyone  at  that  stage,  and  at  least  one  third  of  them  have  nothing  n 
do  with  *:he  electronic  component*  or  circuit  design  and  are  mainly  mechanical  weaknesses.  This  emphasise* 
the  quality  of  design  factor.  Computer-aided  design  shows  some  signs  of  improving  the  situation. 


THE  ENV IRON-MENTAL  STRESS  FACTOR 


In  recounting  the  experience  of  a dip  in  the  early  Duane  plots,  attention  was  drawn  to  the  variation 
of  reliability  with  ambient  temperature,  and  the  desirability  of  normalising  operating  time  to  a standard 
environmental  stress  level. 

A scaling  factor  can  be  derived  from  Fig  7 which  plots  failure  rate  against  component  ambient 
temperature.  For  example,  operating  time  at  80  C would  be  multiplied  by  three  in  order  to  normalise  to 
time  at  20  C ambient.  The  overall  effect  of  temperature  on  equipment  failure  rate  haa  been  calculated  for 
positive  Centigrade  temperatures  using  MIL  HDBK-217A/B  data  on  components.  It  is  believed  that  failure 
rates  also  increase  with  decreasing  sub-zero  temperatures,  because  mecha  cal  stresses  in  parts  increase 
due  to  the  different  expansion  coefficients  of  materials  and  the  higher  moduli  of  elasticity.  It  is  valid 
to  assume  a ?fandard  curve  because  the  percentages  of  resistors,  capacitors,  active  devices  etc  are  fairly 
consistent  for  most  equipments. 

There  if  little  agreed  information  about  the  influence  on  reliability  of  other  environmental 
•tressea  *uch  as  humidity  and  rate  of  change  of  temperature.  In  assessing  the  results  from  growth 
programnes  where  it  ia  usual  to  apply  severe  environmental  stress  cycles,  the  Services  want  to  be  informed 
about  the  predicted  reliability  under  typical  user  conditions  which  are  usually  leas  severe.  V«  agree 
scaling  factor*  for  reliability  to  allow  for  difference*  in  the  environmental  stresses  before  the 
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programme  start*,  admittedly  against  limited  data.  Even  in  the  case  of  MIL-STD-781B  testing  there  is 
apparently  a lack  of  agreement  about  such  scaling  factors  for  environment.  This  is  a subject  which 
deserves  more  attention  by  reliability  engineers. 

On  one  project  an  unusual  environmental  test  cycle  has  been  used,  as  shown  in  Fig  8,  where  the 
equipment  operating  cycle  is  not  in  phase  with  the  temperature  cycle.  The  effect  ia  to  subject  the  equip- 
ment to  varying  rates  of  temperature  change  and  varying  humidit;  conditions.  Switching  operations  take 
place  at  various  temperatures.  The  temperatureQcycle  is  changed  at  monthly  intervals,  one  month  from  room 
temperature  to  *70°C,  the  next  from  room  to  -26  C.  All  this  is  done  in  order  to  enhance  the  chances  of 
showing  up  the  deficiencies  in  the  design  and  manufacture,  end  in  the  operating  procedures.  It  does 
provide  tome  simila.  ities  to  the  changing  conditions  that  will  occur  in  aircraft  use,  although  the 
temperature  range  is  increased.  On  this  project  it  was  provisionally  agreed  with  all  parties  concerned 
that  reliability  standards  observed  using  this  test  cycle  would  be  coubled  to  provided  estimates  for 
reliability  after  settling  down  in  service.  Time  will  tell  how  good  or  bad  this  assumption  was! 


PROGRAMS  PLANNING  USING  GROWTH  MODELS 


The  use  of  the  reliability  growth  model  concept  in  programme  planning  was  a natural  corollary  and 
it  has  made  a valuable  contribution  by  focussing  attention  on  the  importance  of  providing  specific  equip- 
ments for  long  term  testing.  Fig  9 illustrates  planning  for  a radar  with  a requirement  for  250  hr  MTBF. 6 
Three  radars  were  allotted  and  a cumulative  operating  time  of  6000  hr  was  considered  appropriate,  that  is 
twenty  four  times  the  required  MIBF. 

The  concept  was  to  work  back  from  the  required  MTBF  and  calculate  the  reliability  levels  that  should 
be  observed  early  in  development  for  various  growth  rates.  If  the  first  radars  were  poor  initially  then 
deficiencies  would  have,  to  be  detected  fairly  quickly  if  a high  growth  rate  was  to  be  attained.  A 
cumulative  MTBF  of  125  hr  over  6000  hr  of  test  with  a ■ 0.5,  involving  48  failures,  would  give  the  same 
attained  MTBF  of  250  hr  as  an  equipment  having  only  34  failures  with  a - 0.3  and  an  initial  MTBF  approx- 
imately three  times  as  good,  ie  50  hr  as  opposed  to  16  hr  MTBF.  A high  a does  not  necessarily  indicate  a 
good  design  effort  as  is  often  thought;  it  may  reflect  difficult  design  problems  imposed  by  a stringent 
performance  requirement,  or  a poor  effort  on  a straightforward  design.  However  it  does  show  a very 
thorough  effort  to  discover  the  causes  of  failure  and  eliminate  ther.  It  is  worth  noting  that  in  the 
limiting  case  a could  well  approach  zero  with  excellent  design  and  manufacture,  and  everything  would  be 
right  first  time!  Just  random  failures  and  a constant  hazard  rate!  On  this  project,  the  technical 
difficulties  were  considerable,  and  an  a of  between  0.4  and  0.5  was  anticipated. 

Decisions  about  the  number  of  equipments  depend  at  present  mainly  on  cost,  the  available  calendar 
time  and  the  exponential  law  for  appearance  of  systematic  weaknesses.  Other  factors  are  the  target  MTBF 
and  the  growth  rate  anticipated.  As  a general  guide  from  our  experience  to  date,  no  single  equipment  has 
exceeded  3000  hr  of  operation  following  burn-in,  and  2500  hr  per  annum  per  equipment  is  a typical  maximum 
rate  for  accumulating  operating  hours.  The  possibility  of  exchanging  an  equipment  from  the  reliability 
test  programme  after  1000-1500  hr  with  another  equipment  allotted  elsewhere  initially  should  be  considered, 
because  new  types  of  weakness  are  likely  to  be  found. 


No.  of 
Equipments 

Factors 

Target  MTBD  - Hours 

30 

50 

100 

200 

300 

400 

500 

i 

t 

24.0 

24.0 

24.0 

24.0 

24.0 

24.0 

24.0 

P 

0.35 

0.47 

0.62 

0.74 

0.79 

0.82 

0.83 

IK 

398 

274 

178 

131 

115 

107 

102 

2 

t 

24.0 

24.0 

24.0 

23.3 

21.3 

P 

0,42 

0.56 

0.76 

1.0 

1.0 

mgm 

IK 

679 

461 

297 

185 

164 

] | 

3 

t 

BE 

■a 

19.3 

16.2 

14.7 

13.8 

P 

■ 1 

KSa 

1.0 

1.0 

i.O 

1.0 

IK 

EH 

EH 

Cl 

268 

217 

193 

178 

6 

t 

24.0 

24.0 

17.2 

1.1 

9.1 

8.1 

7.5 

P 

0.67 

0.88 

1.0 

1.0 

1.0 

1.0 

1.0 

IK 

1664 

1115 

647 

409 

334 

297 

275 

IK  * test  programme  cost 

t - test  progranme  time  - months.  Maximum  24 
p - proportion  of  target  KTBD  attained 
a ■ Duane  growth  rate  » 0.4 
Initial  MTBD  - 15Z  of  target. 


TABLE  2 


Example  of  RGF  Costs  Analysis 
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In  seeking  to  minimise  total  life  costa  a computer  programme  is  being  developed  that  will  readily 
provide  comparisons  of  the  cost  effectiveness  of  various  options  for  a reliability  growth  programme  (RCF) 
during  the  development  phase.  The  Duane  Model  has  been  adopted  for  estimating  growth.  There  are  fifteen 
input  parameters  to  the  computer  programme,  including  guwth  rate  a,  initial  MTBD  (Mean  time  between 
defects),  test  duration,  number  of  development  equipments,  number  of  engineers  deployed,  down  time  for 
defects,  cost  of  hardware,  cost  of  - . . -:,->litiea  etc.  Printouts  can  be  readily  obtained 
showing  the  effect  of  changing  the  parameters. 

Table  2 shows  an  example  where  a remains  constant  at  0.4,  initial  MTBD  remains  unchanged  at  152  of 
the  target  and  time  is  limited  to  two  years.  Target  MTBD  and  the  number  of  development  models  are  varied, 
and  solutions  are  computed  for  the  MTBD  that  should  be  achieved,  with  programme  time  ana  cost.  It  can  be 
seen  that  costs  increase  with  lower  MTBD  targets  - at  first  sight  perhaps  an  anomaly  - but  a lower  target 
reflects  a more  complex  equipment  with  a larger  component  population  which  will  tend  to  be  more  expensive; 
also  more  defects  are  likely  to  occur  which  will  require  more  effort  on  investigations,  repairs  and 
modifications.  It  will  take  longer  to  accumulate  a specified  number  of  operating  hours  and  all  this  will 
add  to  programme  costs.  Increasing  the  number  of  models  for  a given  target  MTBD  also  increases  programme 
costs,  but  a higher  reliability  standard  and/or  a shorter  progracme  time  should  be  realised.  In  this 
example  the  entire  cost  of  equipments  has  been  charged  to  the  programne,  but  if  they  can  be  utilised  else- 
where afterwards,  some  useful  reductions  can  bt.  accounted.  The  cost  estimates  for  the  RGP  have  to  be  care- 
fully considered  against  the  potential  savings  for  the  Service  life  of  the  total  aircraft  fleet. 

Fig  10  shows  the  effect  on  RGP  costs  in  order  to  attain  a given  target  when  a and  initial  *.*TBD  are 
varied.  The  importance  of  a good  design  effort  in  order  to  achieve  a better  initial  reliability  is  clearly 
evident.  The  higher  the  "growth  rate"  a,  the  lower  the  RGP  costs  as  would  be  e.cpected.  The  percentage 
initial  MTBD  and  a are  rot  entirely  independent,  a low  percentage  initial  MTBD  will  tend  to  be  associated 
with  a high  a and  vice  versa.  The  more  complex  the  equipment,  the  higher  the  proportional  increase  in 
costs  for  a given  percentage  initial  MTBD  in  order  to  attain  the  target.  This  work  on  cost  estimates  is 
at  an  early  stage,  and  we  hope  to  improve  the  computer  programme  as  more  dat  . on  RGP's  is  obtained.  It  is 
a part  of  a serious  attempt  to  miniate  total  life  costs  attributable  to  avionics. 

Let  us  return  again  to  the  question  about  the  number  of  equipments  for  the  RCP.  If  more  equipments 
are  tested,  then  more  weaknesses  are  likely  to  be  found  and  some  will  be  observed  more  quickly  because  each 
equipment  will  be  slightly  different.  Also  investigations  will  be  helped  by  availability  of  other  equip- 
ments for  comparison  purposes  and  for  experimental  interchange  of  assemblies.  The  extent  of  the  improve- 
ment in  reliability  can  be  inferred  from  the  Duane  Model;  if  n equipments  are  used  and  accumulate  nr 
>perating  hours  then,  subject  to  a and  k remaining  constant,  the  attained  MTBF  should  then  be  retimes  that 
for  one  equipment  operating  for  only  t hr  - From  Appendix  Eq.  (3)  - eg  five  equipments  each  operating  for 
2000  hr  with  a “ 0.3  should  achieve  an  improvement  factor  of  5^.3  „ over  the  MTBF  for  one  equipment 

after  2000  hr. 

An  important  point  is  that  each  equipment  should  be  operated  for  at  least  1000  hr,  assuming  a fairly 
severe  test  environment.  This  is  because  of  the  exponential  law  for  the  rate  of  appearance  of  types  of 
systematic  weakness.  For  example  if  this  condition  was  not  met  and  five  eauipments  were  used  to  aggregate 
2000  hr  of  operation,  each  would  only  show  632  of  its  weaknesses  - ie  «.or  a time  constant  of  400  hr.  Even 
allowing  for  some  variation  between  equipments  it  is  unlikely  that  the  total  number  of  types  of  weaki  esses 
would  exceed  that  if  only  one  equipment  had  beer  operated  for  2000  hr,  which  would  be  approximately  9‘  2 of 
those  in  that  single  equipment.  The  corresponding  figure  for  1000  hr  is  922. 

Reliability  growth  modelling  murt  not  be  regarded  as  a panacea  for  evolving  reliable  equipment. 

The  quality  of  design  must  always  be  the  prime  consideration. 


CONFIDENCE  BOUNDS  FOR  DUANE  ESTIMATES 


The  Duane  Model  gives  the  "instantaneous"  or  attained  failure  rate,  but  this  is  a point  estimate  on 
an  undefined  distribution,  and  questions  are  understandably  asked  about  upper  and  lower  confidence  bounds. 
Dr  L H Crow  has  shown7  that  the  Duane  Model  and  the  Weibull  repairable  system  failure  rate  model  are  the 
same,  and  has  defined  a method  for  calculating  the  required  confidence  bounds. 

Against  our  limited  experience,  we  have  been  a little  hesitant  about  the  best  solution  to  this 
problem.  A simole  method  that  has  been  used  is  to  assume  a hypothetical  number  of  failures  given  by:- 

Cumulative  test  hours 
Instantaneous  MTBF 

This  number  is  entered  into  the  usual  Epstein  y formulae  for  confidence  limits,  time  terminated  test, 
exponential  distribution  - see  Appendix  Eq  (7).  Time  is  cumulative  test  hours.  If  can  be  claimed  that 
the  method  is  consistent  with  the  Duane  concept  in  that,  if  no  further  modifications  are  introduced,  the 
cquipme--.  should  exhit.  t the  instantaneous  MTBF  during  further  test. 

Whichever  way  the  calculation  is  tackled,  there  is  still  the  problem  of  how  to  adjust  the  answers 
in  order  to  allow  for  the  different  conditions  of  use  when  the  equipment  is  deployed  in  service.  That  *8 
the  information  required  by  the  customer.  Some  evidence  about  what  happens  following  development  will  now 
be  considered. 


RELIABILITY  GROWTH  AFTER  THE  DEVELOPMENT  PHASE 


It  is  fairly  common  experience  that  there  are  always  teething  troubles  when  a new  equipment  is 
introduced  into  service,  whether  it  i«  electronics  or  motor  cars  or  washing  machines!  With  avionics,  it 
takes  about  18  months  from  first  introduction  before  the  reliability  standard  is  reported  that  was 
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a*hieved  on  late  development  m'del*.  The  reasons  include  * lesrnirg  phase  with  the  new  production  line 
and  a learning  phase  (or  personnel  handling  the  new  equipment.  In  other  words,  more  reliability  growth! 

Pig  11  show*  an  example  of  such  data  for  another  avionic  equipment  inatalled  on  the  tritifh 
Harrier  vertical  take-off  aircraft  end  operated  by  the  IS  Marines.  This  data  haa  been  very  carefully 
compiled  and  all  failures  have  been  investigated  by  the  Br  ’ iah  u.xnuf  ac  turer  • The  initial  reliability 
reported  was  not  at  good  as  expe<ted,  but  it  haa  now  imp*"  *d  to  the  point  that  it  is  much  better  than  the 
original  prediction.  A lew  modifications  aince  intronuc  -n  into  service  have  contributed  to  the  improve- 
ment. The  slope  ia  0.408,  calculated  by  a computer  progiamm*  that  produces  an  equation  for  the  beat  fit 
attaight  line  using  the  method  of  least  squares,  with  progressively  reduced  weighting  for  the  earlier 
plots. 


t perien::t  and  logic  support  the  concept  that  electronic  reliability  ihould  continue  to  improve  with 
time,  providing  transient  overstress  damage  is  avoided.  When  a component  fails  without  any  apparent  reason, 
it  will  often  be  one  whiih  was  slightly  interior  initially,  but  good  enough  to  survive  even  severe  burn-in 
conditions.  The^e  will  be  a very  high  probability  that  the  replacement  will  be  good,  end  so  the  equipment 
hazard  rate  will  have  decreased. 
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The  difficulties  in  making  a numbers  count  type  of  prediction  at  the  start  of  a project  with  any 
marked  degree  of  confidence  are  probably  greater  today  than  ever  before.  So  many  factors,  including  those 
listed  in  Table  1,  can  have  a profound  effect  on  eventual  reliability  in  service.  Fxt rsordinsry  low  failure 
fates  are  quoted  for  many  types  of  component,  yet  slight  lapses  in  the  quality  control  of  a particular 
hatth  could  result  in  a vastly  higher  failure  rate  if  the  substandard  parts  "re  not  detected,  but  the 
main  emphasis  is  almost  invariably  on  performance  and,  despite  uncertainties  about  reliability  estimates, 
development  corrsflences.  Attempts  are  always  made  to  predict  reliability  using  what  is  judged  to  be  the 
best  source  data. 

In  reliability  growth  programme  planning,  there  if  a similar  problem  of  trying  to  predict  the 
initial  MTBF  that  will  be  exhibited  by  the  first  development  hardware.  It  will  be  necessary  to  attempt  to 
iw  allowances  for  the  technical  difficulty  and  the  capability  of  the  design  team.  Dr  Blanks  of 
Austrai  a appreo  iat  **d  the  problems  and  be  asked  the  question**;  "What  value  cf  MTBF  during  the  KTBF-grovth 
phase,  wnirh  can  extend  well  into  the  equipment  operating  (tield  use)  phase,  is  the  reliability  prediction 
process  supposed  to  predict*" 

The  thought  is  beginning  to  emerge  th.t  estimates  based  on  reliability  growth  modelling,  once  some 
operating  experience  has  been  accumul ated,  may  be  more  acceptable  than  the  traditional  prediction.  The 
MIL-HLBk-il 7 B type  of  failure  rate  data  will  still  have  a useful  role  to  play  in  disciplining  the  checks 
by  designers  that  components  should  always  be  operating  at  conservative  electrical  and  thermal  stress 
levels.  Tt  is  also  the  only  basis  st  present  for  attempting  to  quantify  logistics  for  spares  holdings, 
and  for  apportioning  reliability  targets  to  sub-systems. 

FITVRF  AVIONICS  RELIABILITY1 

Looking  to  the  future,  with  a further  increase  in  the  use  of  microelectronics,  it  is  envisaged 
that  th»  factors  of  quality  control  in  manufacture  and  of  burn-in  will  become  more  and  more  important. 

Given  a perfect  design,  delivered  equipment  could  be  quite  unacceptable  if  these  factors  are  not  afforded 
the  right  emphasis, 

The  quality  of  design  is  most  important  and  should  improve  as  computers  are  used  increasingly  as  an 
aid  to  design.  The  more  that  processes  can  be  automated  to  reduce  the  possibility  of  human  error,  the 
better  the  prospect  of  achieving  high  reliability.  That  ia  what  microelectronics  offer.  Circuit 
redundancy  te.hiques  are  likely  to  be  used  more  widely. 

There  are  ground*  for  belie\ing  that  the  overwhelming  majority  of  modern  components  are  potentially 
failure-free  for  the  service  life  envisaged.  Most  failures  onlv  occur  because  of  poor  quality  or  over- 
stress. Reliability  of  future  avionics  will  still  depend  on  the  degree  to  which  envi ronmental  conditions 
at  t installation  can  be  alleviated,  and  on  the  prevention  of  damage  through  human  error  or  transient 
elertriial  overstress. 

There  will  r«ma  n a continuing  need  to  carry  out  extensive  environmental  testing  of  prototype 
equipment  in  order  to  obtain  confidence  that  it  will  meet  reliability  requirements.  It  seems  probable  that 
reliability  growth  modelling  will  become  the  accepted  method  for  assessing  progress. 
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1 Reliability  growth  modelling  is  a valuable  technique  for  sunsgement  in  project  planning,  arJ  for 

monitoring  progress  during  the  development  phase. 

3 Reliability  growth  modelling  haa  proved  very  useful  for  avionics,  and  with  slight  reservations  the 
Duane  Model  appears  to  be  valid. 

1 The  slight  reservations  about  the  Duane  Model  are  for  the  early  time  period,  and  for  the  very  long 

time  per  tod , 

4 The  rata  of  appearance  of  types  of  systematic  failure  follows  an  exponential  law. 


:h 

5 Hot*  attent’on  must  be  given  in  »>delling  to  the  variation  of  reliability  with  different 
environmental  atreaa  levels. 

6 Some  useful  progress  has  been  taade  with  a computer  progratom*  for  costing  reliability  growth 
programmes . 
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APPENDIX  l 


THE  DI  ANE  MDDFL 

J.T.  Duane  of  the  General  Electric  Company  discovered  an  satirical  relationship  between  failure  rate 
and  testing  tis*  for  progransn**  where  a continuous  effort  was  maintained  to  improve  reliability  by  intro- 
duction of  muHf icat iont  following  experience  of  failure.  Toe  discovery  was  first  reported  in  an  internal 
CEC  paper  in  1962.^ 

The  mathematical  for*  of  the  Duane  Ek>del  is  givtn  by  the  expression:- 

• kt‘!1  (1) 

Where  * cumulative  failure  rate  at  time  t. 
k • constant 

t - total  operating  time 

i • a iseasur*  of  reliability  growth,  commonly  called  '‘growth  rate". 

In  calculating  cutwjlative  failure  rate,  all  failures  are  counted. 

If  vumulative  failure  rate  ii  plotted  against  total  operating  time  on  log-log  paper,  the  plots 
should  lie  on  a straight  line  having  slope  f-i). 

The  instantaneous  sttsined  failure  rate  at  tiree  t will  be  lower  than  the  cumulative  failure  rate 
because  improvements  have  been  introduced. 

(I ) can  be  written  as 


where  F ■ total  failures  observed  in  time 

r - kt1'1  (2) 


Th*  initantanaoua  failure  r«(*  i.  obtained  by  differentiation 

Hence  • (1  - r)kt  11  (3) 

It  follow,  that  plota  of  inatantaneoua  failure  rate  against  teat  time  on  log-log  paper  will  alao  lie  on  a 
atraight  line  having  elope  <-i ) . This  line  will  be  parallel  to  the  line  through  plot,  for  cunul.tiv. 
failure  rata. 


Combining  (1)  and  (3)  gives  1. 


(1  - o)» 


i ” ' t 

Since  KTHF  c«n  be  considered  at  the  inverse  of  failure  rate,  equation  (*)  can  be  changed  to  read 

h 

9i  * Fi 


«.) 


(5) 


where  ^ • instantaneous  sttsined  MTBF 

• cumulative  MTBF 

Fquation  (5)  provides  s simple  mathematical  model  by  which  sunagement  esn  quantify  progress. 


The  rate 
From  (l) 


of  change  of  MTPF  is  ottained  by  further  differentiation. 


and  (5) 


kTT^T 

at'  ‘ 1 

»Ti”T 


(6) 


Epstein^  developed  the  following  formula  for  the  single  sided  lower  MTBF  Confidence  Limit 
assuming  an  exponential  distribution. 


L 


2nT 

\Y  Y„— r'--T) 


(7) 


1 


where  n 
T 


a 

r 


number  of  equipments  on  te»t 

teat  time  for  each  equipment,  same  for  each 

1 - Confidence  Coefficient 

total  number  of  failures 
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ILLUSORY  RELIABILITY  GROWTH 


W.  T.  SUMERLIN 
Engineering  Consultant 
P.  0.  Box  lfll 

Haielwood,  Missouri  63042,  U.S.A. 


SUMMART 

Tha  prsssnt  meaning  of  Reliability  Growth  is  Identified  and  contrasted  to  earlier 
concepts.  Present  need  to  devise  effective  means  foi  administering  the  later  phase  of 
avionic  development  is  reeognlied.  It  is  during  this  development  phase  that  an  abundance 
of  system  failures  caused  by  shortcomings  of  design,  workmanship,  and  parts  selection, 
mask  more  or  less  completely  the  inherent  reliability  achievable  upon  development  comple- 
tion. The  mathematical  uncertainty  of  prognosticating  a valid  schedule  for  elimination 
of  all  pattern  failures  and  achievement  of  required  reliability  on  the  basis  of  early 
test  experience  is  examined.  It  is  concluded  that  accepted  means  must  be  used  for  quan- 
titative MTBF  measurement  in  the  absence  of  pattern  failures,  and  that  quantitative 
values  for  MTBF  produced  by  typical  growth  monitoring  in  the  presence  of  an  abundance  of 
pattern  failures  can  be  dangerously  misleading. 


INTRODUCTION 

The  term  “Reliability  Growth*  in  the  lust  few  years  has  assumed  a meaning  somewhat 
different  than  in  earlier  years.  In  the  la\.e  1940*e  when  reliability  as  an  engineering 
specialty  first  emerged,  the  failure  rate  of  electronic  and  avionic  systems  was  gener- 
ally found  to  be  relatively  constant  during  the  useful  life  of  the  system,  and  constant 
failure  rate  mathematics  (probability  and  statistics)  quite  adequately  sufficed  for  reli- 
ability problem  solving.  With  the  emergence  of  aolid  state  circuitry.  Borne  evidence 
began  to  appear  here  and  there  to  the  effect  that  the  failure  rate  of  solid  state  ele- 
ments (notably  transistors  and  diodes  at  the  time)  sometimes  decreased  somewhat  during 
the  life  of  the  system.  This  decrease  was  more  a gradual  and  uniform  change  over  the 
entire  useful  life,  rather  than  a rapid  decrease  during  early  life  and  relatively  con- 
stant failure  rate  thereafter;  The  existence  of  this  phenomenon  brought  forth  identifi- 
cation as  “reliability  growth*.  The  extremely  low  failure  rates  of  the  more  successful 
solid  state  elements,  especially  integrated  circuity,  rapidly  led  to  the  development  of 
increasingly  complex  avionic  systems  and  the  establishment  of  design  guidelines  for  solid 
state  circuitry  and  digital  design  considerably  different  than  the  customary  design  ap- 
proaches of  the  past.  The  lure  of  expanding  vistas  for  electronics  and  avionics  brought 
large  numbers  of  apprentice  designers  into  the  profession.  Underntandably,  the  character- 
istic that  frequently  brought  u>  the  rear  of  the  development  procession  was  reliability. 
Unfinished  developments  sometime' i were  released  for  production  because  of  overly  opti- 
mistic development  time  tables.  The  frequency  of  failure  in  operating  hardware  that  had 
not  been  meticulously  shepherded  through  to  the  proper  end  of  development  was  Intolerably 
high  but  could  be  made  to  decrease  to  varying  extents  in  response  to  development  "clean- 
up". Again,  and  understandably,  the  term  “re  lability  growth*  now  appeared  more  and  more 
frequently  in  programs  going  through  the  final  stages  of  development  after  production  had 
already  begun.  Reliability  growth  in  this  application  can  not  imply  that  any  element  of 
the  avionic  design  has  a failure  rate  which  will  gradually  decrease  over  its  useful  life. 
Rather,  the  implication  is  to  unfinished  development,  suffering  from  an  unnecessarily 
high  failure  rate  because  of  design  error,  workmanship  insufficiency,  and/or  poor  parts 
selection.  The  improvement  in  failure  rate  can  only  come  about  because  of  significant 
qffort  on  the  part  of  development  personnel  to  rectify  these  shortcomings.  The  signifi- 
cance of  identification  of  such  so-called  reliability  growth  is  that  it  la  difficult  to 
ascertain  before  hand  as  to  Just  how  much  the  failure  rate  can  be  reduced  with  effort 
limited  to  practical  bounds.  This  paper  is  then  chiefly  concerned  with  reliability 
growth  and  present  approaches  to  its  control  when  considered  in  respec.t  to  failure  rate 
reduction  by  specific  effort  in  the  areas  of  design,  workmanship,  and  parts  selection. 

mass  real  background 

Tn  the  early  days  of  reliability,  equipment  and  systems  for  which  high  reliability 
was  f portent  received  very  close  development  scrutiny.  Laboratory  procedures  fostered 
the  emergence  and  identification  of  failure  mechanisms.  Those  Judged  to  be  likely  fre- 
quent repeaters  were  eliminated  through  design,  workmanship,  and  parts  selection  efforts. 
With  some  patience,  a system  would  reach  the  point  where  the  last  hundred  or  so  failures 
would  Include  no  two  like  failure  mechanisms.  This  resulting  heterogeniety  of  failure 
mechanism  guaranteed  that  the  exponential  distribution  would  accurately  describe  t^e 
probability  of  future  failure,  and  it  yielded  constant  failure  rate  reliability.  For  a 
system  which  had  reached  a condition  of  unrepeatlng  (even  though  frequent)  failures,  it 
was  found  that  further  permanent  elimination  of  failure  mechanisms  did  not  produce  meas- 
urable reliability  improvement  In  near  future  operation.  If  reliability  was  still  too 
low  (unrepeatlng  failures  too  frequent),  major  redesign  often  involving  basic  change  of 
design  approach  was  Judged  essential. 

With  constant  failure  rate  equipment  and  systems,  techniques  lor  reliability  (MTBF) 
measurement  were  developed  and  improved  to  permit  maximum  confidence  in  minimum  test 
time*.  Such  measurement  via  test  is  well  known.  It  is  important  that  most  such  proce- 
dures insist  that  if  pattern  failures  (repeating  failure  mechanisms)  appear,  the  test  is 
invalidate  i.  In  other  words,  the  test  is  valid  only  so  long  as  heterogeniety  of  failure 


3-: 


Today,  In  tha  presence  of  high  complexity,  solid  atata,  digital  avionic  design,  aoaa 
davalopara  can  be  found  who  auccaad  In  permanently  eliminating  all  failura  aachaniaaa  of 
high  rapatitlon  frequency  during  thalr  scheduled  development,  and  who  than  parfora  a stand- 
ardized constant  failure  rata  rallablllty  verification  taat  and  establish  tha  presence  of 
adequate  reliability  without  need  for  post-test  remedy.  While  such  a feat  for  a develop- 
ment which  departs  but  slightly  from  a design  of  long  standing  and  great  experience  may  be 
Judged  nov  especially  exceptional,  there  have  been  cases  of  such  accomplishment  with  radi- 
cally new  design.  Probably,  however,  tha  majority  of  developments  are  forced  to  choose 
between  minimal  departure  from  past  adequate  design,  end  extended  effort  to  obtain  needed 
reliability.  Unfortunately  tha  need  for  development  business  end  the  large  number  of  would- 
be  customers  with  limited  funds  end  high  reliability  demands  leads  to  many  perplexing 
situations. 

In  the  last  ten  years  there  hsa  been  an  ever  increasing  technical  press  addressing  the 
aforementioned  most  recent  concent  of  reliability  growth.  Some  customers  are  proposing 
means  to  hopefully  assess  reliability  very  early  in  the  development  evolution  of  lunction- 
lng  hardware,  and  then  to  follow  the  apparent  reliability  during  a protracted  testing  pro- 
gram in  order  to  measure  reliability  growth.  From  such  findings  it  is  hoped  to  be  possible 
to  predict  further  future  reliability  growth  against  future  schedule  and  available  funds, 

In  order  that  decision  may  b#  made  as  to  ultimate  reliability  success,  and  appropriate 
action  taken  early  if  necessary.  Thus  it  would  seem  vital  to  scrutinize  popular  techniques 
for  supposedly  measuring  reliability  growth  to  determine  whether  the  calculated  growth  la 
illusory  or  real. 

The  basis  for  one  of  the  more  If  not  the  most  popular  growth  measuring  technlqua  la 
the  1970  reliability  approach  advocated  by  General  Electric  and  identified  ws  “Reliability 
Planning  ar.d  Management  (RFM)"Z.  This  technique  in  turn  Is  based  on  a 1962  paper  by  a G.E. 
employee,  Mr.  J.  T.  Duane’,  and  further  elaborated  In  196B  In  a paper  by  E.  0.  Codler**, 
also  of  G.E,  Messrs.  Selby  and  Millar  characterise  their  RPM  theory  by  uaing  the  "Duane 
Plot"  to  track  reliability  growth  over  an  extended  development  test  period  which  typically 
accumulates  ten  thousand  operating  hours  of  test.  They  note  that  reliability  at  the  begin- 
ning of  the  Duane  Plot  (usually  after  one  hundred  hours  of  test)  is  typically  ten  percent 
of  the  predicted  MTBF,  and  most  often  can  be  expected  to  rise  at  a rate  proportional  to  tha 
square  root  of  the  accumulated  teat  time.  In  1973.  G.E.  concluded  a study  which  applied 
the  Duane  method  of  growth  assessment  to  several  multi-year  equipment  developments.  In  the 
final  report?  It  la  noted  that  evidence  of  reliability  growth  dapends  on  the  distribution 
of  failure  mechanisms,  the  detection  of  failure  mechanisms,  and  the  rate  of  failure  removal. 
Typically,  newly  developed  equipment  exhibiting  MTBF  at  ten  percent  of  the  predicted  value 
was  found  to  be  constrained  by  problems  equally  divided  among  design,  workmanship,  and  parts. 
If  design,  workmanship,  and  parts  wsre  all  less  deficient  Initially,  then  the  MTBF  would 
Initially  be  closer  to  the  predicted  value.  Obviously  if  failure  observations  enter  growth 
calculations  before  very  much  development  clean-up  has  taken  place,  failure  frequency  will 
decrease  as  clean-up  progresses.  However,  as  G.E.  has  observed,  the  distribution  of  failure 
nechar.lams  must  Include  a significant  proportion  of  high  failura  rats  mechanisms  (to  provide 
the  easy  to  recognlts  pattern  failures),  which  are  relatively  ess/  to  detect  (thus  receiving 
specific  attention)  and  quick  to  permanently  eliminate  (in  order  to  provide  readily  recog- 
nizable reliability  growth).  Many  case  histories  confirm  that  this  situation  Is  frequently 
encountered. 

If  MTBF  calculations  must  await  completion  of  most  of  the  design  and  workmanahip  clean- 
up, and  it  Is  then  found  that  the  remaining  observable  failures  do  not  readily  respond  to 
further  clean-up  effort,  and  this  failure  rate  Is  unacceptably  high.  It  Is  very  late  in  the 
program  to  begin  th#  needed  basic  redesign.  There  Is  little  question  as  to  the  desirability 
for  some  mesne  to  assess  the  level  and  rate  of  decrease  of  failure  rate  at  the  earliest 
possible  moment  In  development  evolution,  provided  such  assessment  can  lead  to  a correct 
hypotheala  concerning  the  possibility  of  reaching  the  required  reliability  within  a critical 
schedule. 

MATHEMATICAL  VALIDITY 

Probability  is  the  mathematical  m»ans  for  progressing  from  general  laws  of  physics 
(nature,  etc.,)  to  specific  circumstances  when  it  is  desirable  to  predict  the  future.  Thus 
If  we  have  the  true  MTBF,  and  know  that  It  will  remain  constant  In  the  Intended  application. 
It  Is  possible  to  calculate  the  probability  of  future  failure.  Statistics,  conversely, 
embrace  the  mathematical  means  for  progressing  free  specific  observations  to  general  laws, 
end  induction  is  required.  Because  of  the  nature  of  the  universe  and  our  limited  knowledge 
of  It,  statistics  is  a much  broader  field  of  mathematics  than  is  probability.  Hopefully 
we  limit  the  uce  of  statistics  tot  1)  the  situation  where  ws  are  unfamiliar  with  the 
physical  laws  that  pertain,  and/or  2)  the  situation  where  the  detallj  of  all  controlling 
factors  are  known  but  so  volut inous  that  a detailed  exact  calculation  is  not  Justified  in 
the  presence  of  available  statistical  accuracy.  In  reliability  ws  may  be  able  to  mathe- 
matically describe  sufficiency  one  or  more  actual  failure  mechanisas,  but  in  general  ws 
cannot  bavin  to  describe  any  significant  quantity  of  failure  mechanisms  to  permit  exact  cal- 
culation of  failure  probability.  Generally,  where  enough  is  known  of  a particular  mechanism. 
It  becomes  practical  to  eliminate  It. 

The  fact  that  a heterogenietv  of  failure  mechanisms  permits  them  to  be  considered  with 
the  exponential  distribution  has  more  than  anything  else  made  it  possible  to  measure  MTBF 
and  calculate  probability  of  future  failura  with  useful  accuracy.  Knowing  Inclusion  of  any 
failure  mechanisms  whose  prevalency  upsets  this  heterogeniety  principle,  leads  to  error  and 
gross  error  In  the  computation  of  MTBF  based  on  observed  failures.  On  the  other  hand, 
repetitive  (pattern)  failures  are  bound  to  exist  to  some  extent  during  a development,  and 
such  mechanisms  must  be  eliminated.  Hence  close  scrutiny  cannot  be  denied  them.  Thus  the 
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y*t  taken  place,  and  MTBF  assessment  Is  based  on  an  "if  they  are  eliminated*  basis,  then  the 
accuracy  of  MTLF  assessment  will  hinge  on  adequacy  of  later  elimination,  absence  of  any 
related  design  deterioration  or  Introduction  of  new  failure  mechanise,  and  similar  consider- 
ations, 

DUANE  FtOT 

The  Duane  Flot,  as  illustrated  herewith,  at  the  time  of  each  failure  takes  a measure- 
ment of  the  total  operating  time  of  the  system  on  test,  and  divides  this  time  accumulation 
by  the  total  number  of  failures  observed  up  to  that  time.  This  quotient,  aa  so-called  cumu- 
lative FTBF,  is  plotted  versus  the  aforementioned  total  accumulated  time  on  log-log  graph 
paper.  It  is  customary  to  recommend  -hat  the  first  plotted  point  be  at  one  hundred  hours 
time  or  at  the  time  of  the  next  failure  thereafter.  For  typical  equipment  the  test  may  be 
continued  if  all  goes  well  until  as  many  aa  ten  thousand  hours  are  accumulated,  in  order  to 
display  all  the  significant  reliability  growth  to  be  encountered.  It  is  usually  expected 
that  the  one  hundred  hour  cumulative  FTBP  will  be  approximately  ten  percent  of  the  predicted 
FTBF,  and  that  the  slope  of  the  plot  as  more  and  more  points  are  plotted  will  approximate 
the  one-half  power  of  accumulated  time. 


During  the  one  hundred  initial  hours  of  operation  consideration  can  be  given  *o  Just 
what  rules  will  govern  data  collection.  Decision  must  be  made  aa  to  what  time  to  count  and 
which  failures  to  count.  Unnecessary  inflation  of  the  failure  count  will  yield  low  HTBF  but 
more  significant  positive  reliability  growth.  Austere  failure  counting  may  lead  to  admin- 
istrative difficulty  concerning  whether  to  count  certain  future  failures.  Generous  decision 
for  time  counting  makes  possible  reaching  the  and  of  the  teat  (tan  thousand  hour*)  by  an 
earlier  date  but  it  may  raise  administrative  question  aa  to  the  adequacy  of  performance 
during  all  counted  time.  In  any  casa  is  must  be  noted  that  MTBF  in  the  presence  of  pattern 
failures  cannot  be  used  to  calculate  system  reliability,  and  thus  the  MTBF  plotted  on  the 
Duane  r.'raph  early  in  the  teat  period  is  indicative  of  growth  but  not  of  reliability. 


. of,the  illustration  of  hypothetical  Duane  Plots  for  three  different  also 

hypothetical  equipments  can  offer  some  Insight,  Tha  upper  curve  illustrates  reliability 
growth  proportional  to  the  0.6  power  of  time.  Failures  number  3 (at  275  hours)  through 
number  12  (at  8800  hours)  are  plotted  as  if  they  occurred  at  the  precise  moment  to  mathe- 
matically make  the  plot  follow  a straight  line.  In  real  life  the  actual  time  of  each  failure 
occurrence  would  be  far  more  randomited,  and  a plot  like  that  illustrated  could  only  be 
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expected  If  a large  number  of  equipments  were  b-lne  tested  simultaneously,  and  the  plotted 
point  represented  the  average  time  of  failure  occurrence. 

The  middle  curve  ia  for  the  highly  touted  growth  characteristic  where  KTBF  la  propor- 
tional to  the  square  root  of  accumulated  teat  time.  The  lower  curve  is  for  MTBF  propor- 
tional to  the  0,4  power  of  time.  On  the  horizontal  50-hour  calibration  line  are  marked  the 
time  of  occurrence  of  successive  failures  as  would  be  expected  If  no  growth  took  place  (a 
failure  every  fifty  hours  on  the  average).  With  the  sequence  number  of  each  failure  iden- 
tified for  each  of  the  four  conditions,  the  Illustration  makes  it  possible  to  see  how  much 
the  failure  rate  is  spread  out  or  closed  up  for  a given  change  In  slope.  In  an  actual  test, 
the  randomized  time  of  occurrence  of  each  failure  distinctly  separate  early  in  the  teat 
permits  considerable  option  on  Just  what  slope  straight  line  is  Judged  beet  fit  for  the  data. 

This  type  of  plot  can  be  seen  to  smooth  Initial  data  least  and  final  data  most. 

Initial  data  reflect  MTBF  calculations  with  greatest  departure  from  true  MTBF  because  of  the 
presence  of  pattern  failures  in  large  measure.  The  randomited  time  of  their  occurrence 
greatly  obscures  early  slope  Indication.  The  smoothing  effect  on  final  data  brought  about 
by  the  mass  of  early  data  still  Included  In  each  calculation  tends  to  negate  the  Increased 
value  of  MTBP  evaluation  based  on  data  with  most  of  the  pattern  failures  eliminated.  The 
close  spacing  of  failures  toward  the  end  of  test  make  the  plot  quite  insensitive  as  an  indi- 
cator of  change  of  slope  as  could  be  brought  about  by  exhaustion  of  the  supply  of  pattern 
failures,  with  the  result  that  the  test  Is  likely  to  continue  for  come  time  unnecesserlly 
after  reliability  growth  has  stopped.  In  summary,  the  Duane  Plot  may  be  more  an  indicator 
of  skill  In  establishing  optimum  rules  for  data  collection  and  starting  the  plot  to  yield 
a desired  slope  than  an  Indicator  of  how  much  development  elean-up  Is  needed,  when  it  is 
likely  to  be  finished,  and  whether  the  then  resulting  reliability  will  be  sufficient. 

Mathematical  evaluation  of  the  cumulative  log-log  plot  shows  that  the  instantaneous 
value  of  the  ordinate  (instantaneous  reliability)  can  be  calculated  by  multiplying  :he  plot- 
ted cumulative  ordinate  by  l/(l-a)  where  a ia  the  slope  of  the  best  fit  straight  11 1# 
through  the  plotted  points.  For  the  middle  curve  where  the  sloi’O  it  i,  the  lnstantsneous 
reliability  (MTBF)  is  twice  the  plotted  value.  However,  since  the  slope  is  so  dependent  on 
early  plotting  technique  and  data  processing  rules,  trus  MTBP  should  be  determined  by  ac- 
cepted verification  test  means  rather  than  by  assessment  of  the  Duane  Plot. 

CONCLUSIONS 

The  need  to  devise  and  employ  m«ans  for  early  asaesament  of  reliability  during  the 
development  cycle  is  real.  The  existence  of  a proliferation  of  pattern  failures  la  usual. 
Reliability  prediction  if  properly  performed  has  specific  value,  and  standardized  relia- 
bility verification  teats  can  be  valid  for  measuring  true  reliability  is  properly  performed. 
Monitoring  the  process  of  pattern  failure  elimination  can  be  an  administrative  necessity  in 
many  situations.  The  basic  danger  in  popular  reliability  growth  control  methods  la  In  the 
assumption  of  accuracy  of  MTBF  when  calculated  in  the  presence  of  many  pattern  failures, 
and  In  any  asai  mptlon  that  reliability  growth  can  be  counted  upon  to  follow  straight  line 
properties,  to  have  a particular  slope  (or  even  a positive  slope),  and  to  be  predictable 
for  Identifying  end  reliability  within  a particular  achedula. 
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SUMMARY 

The  status  of  current  avionics  reliability  in  the  field  has  been  evaluated  by  a study  of  98  types  of 
avionics  equipment  used  in  a variety  of  aircraft  during  a six-month  period  in  1970.  The  MTBFs  were 
analyzed  by  aircraft  type  and  by  equipment  category  (i.  e.  . communication,  radar,  flight  controls, 
computers,  etc.)  to  reveal  correlations  with  functional  complexity.  About  4,000  in-flight  malfunctions 
from  one  type  of  aircraft  covering  28  different  equipment  types  were  investigated  to  show  failure  modes, 
repair  actions,  and  probable  design  causes. 

INTRODUCTION 


In  order  to  satisfy  demands  for  increased  operational  capability  in  high  performance  aircraft, 
avionic  systems  are  necessarily  becoming  functionally  more  complex.  This  growing  complexity  has  led 
to  more  reliance  on  computer  techniques  for  the  automation  of  system  operation  and  control,  particularly 
in  special  purpose  aircraft.  Although  reliability  of  systems  (given  the  level  of  complexity)  b improved 
in  recent  years,  the  increased  complexity  required  in  new  systems  may  compromise  tha.  reliability 
achievement.  The  tradeoff  between  complexity  and  reliability  leads  to  critical  questions  for  aircraft 
system  project  managers  and  avionics  equipment  designers  undertaking  a new  development  program: 

(1)  Will  the  proposed  new  avionics  design  satisfy  the  specified  mean-time-between-failures  (MTBF) 
requirement 

(2)  In  what  technical  areas  (e.g.  , failure  modes)  should  design  effort  be  emphasized  to  achieve  the 
specified  requirement  ? 

(3)  How  much  development  phase  design  evaluation  testing  should  be  expected  to  actually  achieve  and 
demonstrate  the  specified  reliability  requirement? 

This  paper  deals  with  the  first  two  questions  and  provides  a basis  for  another  paper  responding  to 
the  third. 

AIRCRAFT  PROBLEM  AREAS 


The  avionics  subsystem  is  involved  in  more  aircraft  failures  than  any  other  subsystem,  as  shown  in 
Figure  1.  The  distribution  of  "problem  areas"  within  major  subsystems  in  several  types  of  military 
aircraft  (attack,  fighter,  helicopter,  and  special  purpose  transport  types)  is  the  result  of  an  analysis  of 
field  failure  reports  for  1.2  million  aircraft  failures  observed  during  more  than  a million  flight  hours. 
Avionics  subsystems  experienced  one  failure  in  about  2.8  flight  nours.  Because  of  differences  in  avionics 
complexity  and  other  factors,  the  proportion  of  avionics  failures  to  total  failures  ranged  from  27%  in 
helicopters  to  52%  in  supersonic  fighters. 


Figure  1.  Aircraft  Problem  Classificatic.  , 
All  Aircraft  Types  Combined 


es. 


Some  of  the  avionics  equipments  observed  were  procured  under  contracts  that  included  a reliability 
specification  (R-Spec)  as  part  of  the  overall  design  specifications.  The  observed  MTUt-s  or  those 
avionics  equipments  purchased  under  R-Spec  conditions  are  plotted  for  each  aircraft  type  m t igure  2 
against  complexity,  for  comparison  with  average  past  MTBF  experience  represented  by  MIL- STD- 756 
predictions  <6n>.  Overall,  the  mix  of  installed  R-Spec  avionics  equipments  across  all  types  of  aircraft 
shows  MTBFs  higher  by  a factor  of  better  than  two-to-one  than  would  have  been  predicted  by  Mll.-STU- 
.5u,  based  on  equipment  failures  reported  in  approximately  285.000  flight  hours. 


Figure  2.  Observed  Avionics  MTBFs  of  "R-Specified"  Equipment 
Installed  on  Various  Aircraft  Types 


A direct  comparison  between  R-Spec  avionics  equipment  and  equipment  without  contractual  reliability 
requirements  (Un-Spt>c)  is  presented  in  Table  1,  by  aircraft  type.  The  last  column  of  this  table  gives  the 
ratio  between  specified  and  unspecified  MTBFs  for  each  type  ot  aircraft.  One  should  note  that  complexity 
of  the  typical  equipments  is  not  the  same  for  each,  and  an  adjustment  for  complexity  is  made  in  the  later 
analyses.  I 


Table  1.  Avionics  MTBF  in  Military  Aircraft 
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in  the  Avionics  System 

AEG 

(Avg 

N/n) 

®P 

(hrs) 

a 

(hrs) 

3/eP 

Mu 

(A)  Subsonic  Jets  (At 

R-Spec 

Un-Spec 

Total 

ack  - 3 

19 

5 

Basic 

4709 

487 

rypes) 

300 

97 

10.5 

46 

27 

70 

2.56 

1.54 

24 
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318 

!S) 
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9 

31 
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31 

20 

52 

35 
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40 
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170 

21 

37 

1.74 
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Un-Spec 

Total 
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8 

8 
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i) 

30 

33 

39 

34 

1.34 

1.03 

16 
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31 

37 

1.  17 
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(E)  Helicopters  (Assa 

R-Spec 

Un-Spec 

Total 

ult  - 3 

6 

13 

3asic  T 

800 

1681 

ypes) 

133 
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38 

33 

62 

35 

1.61 

1.07 

19 

_____ 

2481 

131 

34 

40 

1.  18 

1.51 

CURRENT  RELIABILITY  STATUS  OF  AVIONICS 


A total  of  98  different  avionics  equipment  types  (predominantly  analog-function)  in  8 basic  functional 
categories  were  involved  in  the  analyses  shown  in  Figures  1 and  2.  Only  35  of  the  98  types  had  been 
developed  under  contractually  specified  MTBF  requirements.  A 130%  improvement  (2.3- to- 1 ) in  analog- 
function  avionics  equipment  reliability  (MTBF)  appears  to  have  been  achieved,  on  the  average,  in  avionics 
equipment  developed  under  specified  requirements.  Those  developed  without  specified  requirements 
achieved  MTBFs  approximately  60%  higher  than  predicted  by  M1L-STD-756.  A graphical  comparison 
between  the  achieved  reliability  and  the  avionics  reliability  prediction  curve  of  MIL-STD-756  is  shown 
in  Figure  3,  based  on  numerical  data  presented  in  Table  2. 

The  MIL-STD-756  prediction  procedure  was  developed  in  the  late  1950s  on  the  basis  of  data  compiled 
from  in-flight  experience  on  predecessor  avionics  equipments  of  similar  functions.  The  predecessor 
equipments  were  operational  in  1958,  and  the  current  data  apply  to  equipment  operational  in  1970.  Thus, 
the  2.3-to-l  MTBF  improvement  in  R-Spec  avionics  equipment  was  achieved  in  1.2  generations  (i.e.  . 10 
years  per  generation)  of  equipment  design  (development  during  a period  when  reliability  was  receiving 
considerable  attention  but  had  not  been  uniformly  converted  into  design  specifications.  Overall,  a relia- 
bility requirement  contractually  specified  resulted  in  MTBF  45%  higher  than  '.hat  achieved  by  systems 
without  specified  requirements. 
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Figure  3.  Typical  MTBF  for  9 Basic  Equipment  Categories.  Based  on 
35  Avionics  Equipments  With  Contractually  Specified  Reliability  Requirements 


The  scattergrams  of  average  MTBFs  and  functional  complexity  (in  AEGs*)  for  the  35  avionics  equip- 
ments (within  the  9 categories)  show  both  "observed"  achieved  MTBFs  and  their  corresponding  specified 
MTBFs.  Specified  MTBF  requirements,  on  the  average,  generally  fall  between  the  upper  "inherent" 
MTBF  boundary  predicted  by  MIL-HDBK  217  part/stress  analysis  (for  aircraft  "inhabited”  environmental 
conditions),  and  the  lower  MTBF  boundary  predicted  by  MIL-STD-756  AEG  analysis  (for  aircraft  "uncon- 
trolled" environmental  conditions).  It  can  be  deduced  from  the  scattergram  that  the  relative  complexity 
of  the  equipment  was  not  always  considered  in  specifying  the  particular  value  of  MTBF.  However,  using 
the  average  "specified"  MT3F  line  in  Figure  3,  it  would  appear  that  a 10-to-l  improvement  over  previous 
MTBFs  (as  predicted  from  MIL-STD-756)  had  been  desired. 


An  active  element  group  (AEG)  is  defined  as  a circuit  function  comprisin'  one  active  element 
(transistor,  electron  tube,  integrated  circuit,  relay,  etc.)  and  its  associated  passive  elements  (resistor, 
capacitor,  inductor,  connector,  etc.),  as  defined  in  MIL-STD-756A. 
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Table  2.  Avionu  n M 1 I i 1 ' /<  'omplejuty  Analysis 
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\ allies  of  A,,  A , ' 1 0 OKis  he  duo  t » one  or  more  reasons: 

• Different  rs  »»»r.  f . mal  per  form an»  *•  requirements  not  adequately 
reflet  ted  (n  f,.e  pi  edition  methods  of  MU.- ST  I#-  756  A. 

• Different  *«?  m equ.pmenf  .n-f  light  operating  duty  cvc  le  (not  reported  from 
the  field  .« f <1  hem  e not  i compensated  for  tn  the  data  anslvst*). 

• M I 111  i equirements  < <mt*  a tuallv  spec  ifi  ed  too  late  in  the  ac  qumition 
program  ♦>»  ha\  e an*  signifn  ant  influence  on  design. 


ihi>*  study  reveals  that  Ml  HI  a*  t .ftvpmrnts  to  date  are  still  far  short  of  specified  requirements 
l e . l«-s  than  2 V*n  of  the  specified  M 1 HI  was  actually  achieved  in  the  field.  To  illustrate,  assume  that 
j new  item  of  avionn  s equipment  is  to  he  procured  to  satisfy  a specified  MTHF  * 200  hours.  Assume  the 
design  will  require  approximately*  200  Alim  to  perform  specified  functions.  From  Figure  3,  it  can  he 
dr  t*  » m i M#*d  that  this  item  will  achieve  an  ir  flight  MTHF  of  approximately  45  hours,  based  on  current 
av«rage  experience.  I him  our  e*per»en<  e indicates  that  the  item  will  he  designed,  developed,  manu- 
fa>  to’ed,  arid  deliv*trd  to  the  customer,  where  its  observed  MTHF  under  service-use  (operation  and 
tn  i inter  sn»  * > conditions  will  he  4r>  hours  --  i.  e.  9 less  than  25^>  of  the  specified  200- hour  contract 
r equ i rement . 

A'hievemetif  of  npe«  died  MIHFs  cor  responding  to  the  average  specified  MMlF  line  in  Figure  3 is 
fc  “ **  hl»  »l  auffi*  uM  design  e-  «lut**.»n  testing  is  performed  during  the  design /development  phase  to  identify 
’ • failure  moih’S  and  * or  re  • the  underlying  failure  causes.  This  must  include  enough  environmental  test- 
ing wine  i *m  ulatfd  air  i raft  inst.i  Hat  ion  to  verify  adequacy  of  each  corrective  action  to  prevent  or  minimwe 
re»utien«#  of  these  failure  modes. 


r i .assififatipn  ok  k^  ii’mi  nt  faii  i uk 


A studv  mi  performed  on  the  avionics  fquipmfnl  for  a xingle  type  of  aircraft.  Th»  vehir  la  for  thla 
deta.led  investigation  was  a turbo-prop  special  servb  e type  aircraft  tip-aunt  It  carried  the  first  Urge 
avionics  subsystem  (28  different  AN/  equipments),  including  an  Intcgiated  electronics  central  nmiputar 
for  system  oparatlon  and  checkout.  Operation  of  much  of  tlia  install*  d avionic  a equipment  waa  tontrollad 
and  monitored  by  a c entral  computer.  A very  important  part  of  the  ayatem  waa  the  software  (romputer 
programs)  by  means  ul  cahiih  data  from  various  system  elements  were  coordinated  and  controlled  for 
Performanc  e of  subsystem  functions.  In  addition  to  the  operational  program,  there  were  several  teat 
and  diagnostic  programs  cahlc  h perform  system  and  equipment  testa  and  provide  trouble  diagnosis  for 
maintenanc  e and  repair  purposes. 

In  general,  failure  modes  (esc  ept  software  failures  In  ne  item)  did  not  vary  apprec  latdy  among  the 
28  avionic  s equipment  types  studied.  Hesults  of  the  failure  analysis  are  presented  in  Table  3,  using  the 
fo'towirig  definitions 

(1)  Hardware  1-  a Hun  s 

• Electronic  --  degraded  or  incorrect  performance,  intermittent  performance,  no  outputs,  shorts, 
opens,  fluctuating  or  unstable  performar.ee  characteristics,  failure  to  transfer  <1.  e.  , switi  hi  to 
redundant  element,  etc. 

• Mechanical  --  broken,  jammed,  bent,  loose,  binding,  or  damaged  mechanical  parts,  fasteners, 
bolts,  electrical  contact /connectors,  support  frames,  panels,  sockets,  etc, 

• f'.nvlrv.  unent  --  exposure  to  excessive  vibration,  temperature,  humidity,  or  other  ambient 
conditions  which  could  have  induced  the  observed  failure. 

• Ocher  --  failures  due  primarily  to  defective  or  burned  out  light  bulbs  in  Indicator  lamps  and 
panel  lamps,  and  blown  fuses  or  defective  circuit  breakers. 

• f nknnwn  --  observed  and  verifiable  equipment  functional  failures  (e  g.  , failure  to  opera'e)  not 
traceable  to  specific  failure  cause,  remo*  ed  and  replac  ed  (or  adjusted)  to  return  the  equipment 
to  operational  status. 

(2)  Software  Failures  Malfunctions  traceable  to  faulty  input  parameters  or  conditions  due  to  v rong 
logic  program  for  computers  or  faulty  tape  or  card  for  program  or  che.  kout. 

(3)  Anomalies  Operating  in-flight  malfunctions  or  failures  to  pass  diagnostic  automatic  test  criteria 
who  h could  not  be  verified  in  maintenance  c heck  out,  these  are  classifted,"No  Defect"  and  returned 
to  service  without  repair. 


Table  3.  Number  of  Kqutpment  Failures  by  Failure  C lassific  ation 
and  Kepatr  Actions  in  28  Types  of  Avionics  Fquipment 


failure  C lassifit  ation 

Equipment  Failures 

Hepair  Actions 
in  I’eri  entage  of 
Failure  C .i  s 

Number 
1?  epnrl  eH 

Perr  ent 
of  Total 

Heplar  e / 
H epa i r 

A «1 1 Vi  A t / 

Alignment 

(1)  Hardware  Failures 

tron if 

760 

1 ?»% 

58% 

41% 

M«*(  hanh  a t 

42  ii 

10 

33 

#7 

Environment  (ln<lu<  ed) 

103 

3 

25 

75 

Other  (Damps,  Fuses) 

4 r>  2 

1 1 

18 

82 

Failure  ('auee  Unknown 

1 Of  8 

26 

66 

34 

All  Hardware  Failures 

28  12 

6'**. 

50% 

50% 

(2)  Software  f ailures 

n 

n 

15% 

m 

(3)  Anomalies 

1 1 7 1 

2<i% 

Cl% 

<»'U% 

Total 

4075 

100% 

35% 

6 5% 

I a • ept  for  one  avi.mi.  a c ent  ral  i nmput er  wherein  I 7%  of 
total  failures  were  due  to  software  failures. 
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A*  indicated  in  Table  3,  45%  or  nil  malfunctions  were  traceable  to  specific  hardware  and  software 
causes.  Unidentified  hardware  problems  (20”'-)  and  anomalies  (2!i%)  combined  produced  55%  of  all  reported 
malfunctions.  these  two  failure  classifications  represent  all  the  "mysterious''  unidentified  interaction*. 
Interface  tolerance  incompatibilities,  and  interference  problem*. 

About  65%  of  all  malfunction*  were  corrected  by  alignment  or  adjustment  (AAA)  actions  not  invo'ving 
repair  or  replacement  OtAlt)  of  hardware  or  software  elements.  The  ra'io  of  AAA  to  HAH  corrective 
ac  tions  serve*  as  another  Indicator  of  Interface  tolerance  and  instability  problem*  not  identified,  since 
about  50%  of  these  AAA  corrective  actions  were  spent  in  chasing  the  anjmalies  described  above. 

For  Immature  de,  igns,  the  anomalies  usually  contribute  al*>ut  one-third  of  all  failures,  and  tins 
pattern  has  been  consistent  over  the  years  among  ail  types  of  electronic  equipments  in  all  Mods  of 
t-  clronments  and/or  functional  applications. 

L IK'HF  MOOT.  ANA  1.YS1S  IN  TVl'K  Al.  AVIONICS  I QU1PMFNTS 

For  design  cosrection  of  specific  failure  modes  observed  in  avionics  equipment  (during  flight  or  teat), 
it  is  necessary  to  first  identify  the  failure  problems  having  significant  Impact  on  reliability  ano  then 
determine  the  failure  causes  underlying  the  observed  failure  modes. 

(1)  Comparison  Hetween  Observed  f ailure  Hate*  and  Predicted  Values 

For  example,  beginning  with  the  lower  level  of  configuration  (e.  g.  , unit,  component,  or  part), 
observed  failure  rates  in  critical  failure  modes  are  computed  and  compared  with  predn  ted  failure 
rales  for  the  same  elements.  For  the  purpose  of  illustration,  consider  a typical  avionics  equipment 
which  had  experienced  48  failures  in  2,000  flight  hours.  As  shown  in  column  <J>  of  Tatde  4.  the 
observed  failure  rate  was  divided  among  26  units  making  up  the  equipment.  The  predicted  failure 
rate  for  each  unit,  shown  in  column  (4),  is  based  on  reliability  stress  analysis  performed  in  accord- 
ance with  MIL-HOHK- 2 17,  and  thuj  represents  the  theoretical  "inherent''  failure  rate  of  each  unit 
attributable  to  parts  and  components  making  up  the  unit.  The  ratio  of  observed  failure  rate  to  pre- 
dicted failure  rate,  k,  is  recorded  in  column  (5),  this  ratio  Indicates  the  degree  of  improvement 
potential  by  correction  of  design  problems  associated  with  individual  units. 


Table  4.  Observed  and  Predicted  Failure  Kates 
in  a Typical  Avionics  Equipment 


Observed 

Predicted 

Failure  Rate 
Ratio 

Observed 

Predicted 

Unit 

Identification 

Number  of 
Failures 

Failure  Kate 
(Failures 
Per  10®  Mrs) 

Failure  Rate 
(Failures 
Per  10®  Mrs) 

(1) 

(2) 

(3) 

(4) 

(5) 

100 

1 

500 

80 

6.  3 

200 

3 

1500 

3200 

0.  5 

300 

0 

0 

300 

0 

400 

13 

6500 

200 

32.  5 

500 

0 — 

0 

500 

0 

1 2200 

6 

'~^3000 

100 

30.0 

2 

1000 

1000 

1.0 

2400 

1 

500 

1000 

0.5 

6 

4000 

400 

10.0 

2600 

5 

2500 

1200 

2.  1 



2500 


i 7 I l U nt  tf\ ln£  M a^.u  ft  Mtlirn  At  rm  ho  I njc  i ncer  in u hive  at  i^at  n .n 

I .iiiurf  rate  ratios  ( h valuer.)  are  plotted  tty  relative  order  of  magnitude,  as  illustrated  in  I igure  4 
1 tip  "r  ti|tpt  ted  ' i -tii'f  itf  K values  in  fun  example  rut  pm  I tt  f i urn  ratios  of  less  than  nt'  r to  r at  u- a of 

between  ttu  pp  Anti  t.mr,  with  -in  average  ratio,  k “•  I 7 . I'l  nhlern  units  it  c nip  itifir-i  n units  400 

Hint  7.00,  whose  ohser  v pit  (a  i till  r rates  gt  eat  1 v r «t  rp.l  |trnln  tlnua  (r , g , , t.y  appc  ox imately  k » 10), 
with  units  100  and  7 t >i>  tprt^t . -.piy  id* nt  if  iptl  as  pit  apei  tr  J marginal  apple  Atlon  a , t'nit  100,  based 
on  on  1 1 our  f a i In  i p , would  tip  t l a s a if  ini  a a a "tnmpr  t »pti " problem  until  fur  tiipr  f light  te  At  tunr  m 

at  t r it  ml  tipfoi  p initiating  any  rot  r pi  t , vp  art  ion.  My  rpilui  log  thp  fa  i turr  r a t*  i in  units  400,  2 700, 

amt  2'i()0,  a 2 to  I itnpi  ovptnpnt  should  tip  a<  hn  vpiI  in  ovpr  all  equ ipnipnl  M l I I <e.  g.  , from  i urrrnt 
Ml  lit'  » 42  hour. a.  to  M t Ml'  » 80  hours).  This  justifies  an  pnginppring  invpstigatinn  of  these  fpt* 
problem  >rpi a to  Ortrr nunp  flip  uiuli-r I ying  f a i turr  causes  rppiling  lorrprtivr  aition. 

Ibis  ttlustr atioti  of  pinptrii  at  lpsign  pvaluation  indie  ates  thp  valntity  of  rrliahility  miprovpnipnt « 
through  ttip  rpthu  lion  of  highest  unit  failurp  ratp*. 


AATIO  OHS4 WVf  O/Hflt DiCTEO  FAILURE  RATE,  k • i/lq, 

Figure  4.  Distribution  of  Unit*  Arrording  to 
Observed  Versus  ! xpei  ted  Fai’ure  Itatp 

(.7)  Inypat  ig  at  ion  of  Failure  Mo.Ipa 
• Hardware  Failure  Modes 

In  gpnpral.  hard-*arp  failure  modes  and  causes  do  not  vary  appreciably  among  analog  functions  of 
different  types  of  avionics  equipment,  t.  e.  . in  distr ibution  among  component  (unit,  module,  assem- 
bly, part,  etc.  ) failure  modes  manifested  in  performance  malfunctions  ot>*  rved  as  'outside  of 
tolerance  limits''  or  ’ inoperative".  These  failure  modes  are  due  largely  to  Inadequate  design  safety 
margins  because  of  insufficient  "derating"  of  parts  (or  their  protection!  against  excessive  exposure 
to  application  or  environmental  stresses.  F igure  5 represents  a tvpiral  design  margin  problem 
underlying  most  avionics  hardware  failures.  F.ven  though  the  initial  (t())  distribution  of  design 
( hararterintirs  may  satisfy  equipment  performance  requirements,  variation  of  the  design  charac- 
teristics (during  operating  time)  is  reflected  in  equipment  performance  variation  and  performance 
failure,  I’erhaps  about  half  of  these  failure  modes  have  been  correctable  by  oi  ganir  at  tons  I main- 
tenance through  alignment  or  adjustment,  half  by  repair  or  replacement  of  the  responsible  Item 
(e,  g.  , circuit  or  part  replacement). 


Figure  A,  Fundamental  Itelationship  Metween  equipment  Performance 
and  Design  Characteristic  Mehavior 
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Figure  t illustrates  this  type  of  problem  related  to  • simple  amnlifirr  < Ircuit  where  voltage  gain 
(Vt>)  la  primarily  dependent  on  stability  of  load  restator  (Up)  and  transistor  collector  currant 
(lent*-  to  Indicate  "circuit"  failure  rat#  related  to  part  characteriatic  variation  during  normal 
equipment  operation.  Variability  tn  circuit  gain  In  tbla  Uluatratlve  problem  might  ba  minimized 
through  feedback  atablliz ation  of  choice  of  negative  temperature  coefficient  reaiator  (Hi,), 

or  tighter  tolerance  (e.  g.  , a 1%)  on  design  value  of  realatanee  used  In  the  circuit. 


ha 


Figure  6.  Characteriatic  Behavior  of  Parts  Rp  and  Qj 
Under  Circuit  Conditions,  as  a Function  of  Time 

Failure  modes  due  to  stress- induced  part  degradation  are  common  in  power  generators  and  ampli- 
fiers (e.  g. , power  supplies,  RF  oscillators,  power  amplifiers,  etc.).  These  failure  modes  usually 
show  high  relative  failure  rates  particularly  in  radar  and  communications  avionics  equip- 

ment. Failure  diagnosis  of  these  failure  modes  often  reveals  high  power  devices  (transistors, 
magnetrons.  TWTs,  klystrons,  RF  tubes,  and  associated  p.'sstve  elements)  operating  near  or 
exceeding  their  maximum  ratings.  A conventional  derating  curve  for  these  types  of  devices  is 
illustrated  in  Figure  7,  showing  the  distribution  of  applied  atresaes  due  to  variation  In  parts  char- 
acteristics (relative  to  average  design  values,  3 and  T).  In  thia  illustration,  about  half  of  the  parte 
in  the  representative  samples  used  in  the  regression  analysis  fell  outside  the  permissible  operating 
region,  as  allowed  by  the  part  specification.  Design  correction  of  these  types  of  problems  may 
Involve  redesign  of  electronic  circuit,  use  of  alternative  choice  of  parts,  modification  of  thermal 
control  subsystem  <e.  g. , heat  sinks  to  eliminate  "hot  spots"),  or  all. 


catwom  nsuki  in 


Figure  7.  Conventional  Derating  Curves  for  Power  Devices 
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• Suf' ware  Ki 1 1 u r r Modes 

So  called  "software  " intf  i (arf  problem*  are  often  encountered  In  c entral  avionic  ■ computers  used 
for  progt  am  need  lyilcin  operation,  sensor  data  pren  easing,  and  sydem  < hri  kout.  Some  software 
proldema  are  not  easily  identified  in  field  failure  leporta.  lor  example,  memory  deterioration 
in  the  c omputer  may  be  related  to  tiarmonir  content,  apikea,  etc.  , of  the  primary  power  source, 
active  memory  may  be  completely  loat  if  aircraft  generators  are  switched  In  flight  or  It  generators 
drop  lead.  In  some  systems,  the  operational  programs  have  no  ’ malfunction"  readouts,  so  mal- 
functions can  only  be  detec  ted  by  go  / no  - go  light  a or  by  Inc  orrect  display  of  tactical  Inform  at  Ion. 

In  these  < sees,  the  computer  will  attempt  to  play",  even  using  erroneous  Input  data  from  an  equip- 
ment which  had  malfunctioned.  In  some  cases,  tapes  may  not  be  Interchangeable  among  all  aircraft 
due  often  to  differences  between  ta(>e  and  equipment  timing,  I.  c.  , certain  oscillator  and  flip-flop 
modules  roay  work  with  one  tape  arid  not  with  another. 

• Anomalies 

Failures  classified  as  "anomalies"  are  often  traceable  to  Inadequate  design  tolerance  margins  at 
internal  input /output  interfaces  (e.  g. , between  parts,  circuits,  units,  etc.  1 within  the  equipment, 
and  Interdictions  with  externally  flight- induced  environmental  or  operating  conditions  which  exag- 
gerate the  Inadequacy  of  these  tolerance  margins.  If  these  "interactive"  conditions  disappear  on 
landing,  the  related  tolerance  problem  also  disappears  and  usually  rannnot  be  repeated  in  post- 
flight checkout  or  maintenance.  For  example,  in  a typical  avionic  equipment,  approximately  G5% 
of  observed  anomalies  were  found  "non-defe  .live"  by  post-flight  checkout  (in  the  absence  of  the 
in-flight  Interactions).  About  10%  of  the  reported  anomalies  were  attributed  to  error*  in  diagnostic 
test  procedures  (and  thus  not  chargeable  to  the  basic  avionics  equipment).  Approximately  5%  of 
all  anomalies  were  tra<  eahle  to  procedural  errors  in  equipment  operation.  Thus,  the  vast  majority 
of  anomalies  are  caused  by  equipment  (output)  performance  variation  (including  intermittent  per- 
formance) and  are  best  identified  through  adequately  .nstrumented  flight  tests  or  ground-based 
equipment  testing  under  simulated  flight-test  conditions. 

In  the  past,  most  anomalous  failures  generated  under  flight  simulated  environmental  testing  were 
traced  to  the  same  types  of  failure  causes  described  under  the  hardware  failure  definitions  given 
esrlier.  Moreover,  we  have  also  observed  that  anomalous  failure  rate  decreases  In  proportion 
to  decrease  in  hardware  failure  rates  as  the  latter  underlying  causes  are  corrected. 

In  conclusion,  significant  improvement  in  avionics  reliability  (e.  g.  , upward  of  10-to-l  growth  in 
MTHF)  is  feasible  in  future  equipment.  However,  conventional  analytical  design  procedures  alone  are 
not  yet  adequate  for  precise  identification  and  drastic  reduction  of  potential  equipment  failures  snd  toler- 
ant e /intersetion  problems  in  new  avionics  designs.  More  extensive  (and  intensive)  empirical  design 
evaluation  techniques  must  be  spplled  In  s formalized,  iterative  design- verification-design  approach  to 
failure- mode /cause  detection  and  correction.  The  major  effort  In  this  empirics!  design  approach  should 
be  concentrated  in  development  testing  where  "feedback"  is  most  effective.  This  approach  should  con- 
tinue in  production  snd  operational  phases  of  the  life  cycle,  througn  thi  use  of  feedback  from  operational 
data  (failure  reports) 

The  amount  of  design  evaluation  testing  required  to  achieve  a given  level  of  specified  reiiabilily 
(MTHF)  beyond  the  current  reliability  (MTHF)  status  in  a program  can  be  accurately  estimated  (within 
bends)  for  purposes  of  acquisition  planning  and  program  control  in  future  systems. 


PANNES  AFFECT  ANT  LA  FIABIUTE 
DES  EQUIPFMENT  ELECTRONIQUES  DE  BORD 
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Inflmtur  Principal  At  I'Armcmcnt  J A Gamier 
Scrrica  Technique  del  TtWcommunicalnna  dt  I'Aif,  Part*- F RANCE 


0-  ISTROPUCTIOW  - 

On  salt  qua  pour  obtenir  des  dqu.pemente  da  bonna  f lability,  on  doit  faira 
daa  afforta  A toua  las  nlveaux  da  1„  »ie  da  l'dquipement  t conception  at  defi- 
nition du  projet , fabrication  du  material,  utlllaation  opdrationnalle.  Cep.n- 
dant  cas  afforta  ne  doivent  paa  ttre  faita  da  faqon  Isolde  t 11  convlent  da 
connattra  le  rlaultat  de  cea  efforts  t autrement  dlt,  la  syatAae  dolt  fonctlon- 
ner  an  boucla  ferrate.  II  faut  done  nettre  en  place  das  moyens  permettant  da 
connattra  la  fiabllid  rdella  en  exploitation  at  laa  pannes  affectont  cette  fla_ 
bllltd. 

Dans  l'Arrrde  de  l'Alr  franqalse,  11  a ltd  'Is  en  place  un  SystAue  Automa- 
tlque  d'Infomatlon  Technique  (SAIT)  dont  le  document  de  base,  la  PIT  (Fiche 
d'Intervention  Technique),  eat  dtabll  chaqua  foie  qu'une  panne  ou  une  anomalle 
quelconque  apnaralt  lore  de  l'utillsatlon  d'un  dqulpement.  Entre  autres  applica- 
tions, ce  systems  d' Information  facilite  1 ' introduction  de  Olauees  de  flabllitd 
Carantle  dans  un  certain  norabre  da  contrats  d'achats  d'Aquipements  dlectroni- 
ques  de  bord.  L'applicatlon  de  ces  clauses  a ltd  une  occasion  remarquabla  d'a- 
nalyse  de  la  flabilltd  rdelle  en  exploitation. 

llous  allons  done  ddcrire  ce  systAme  automatique  d’information  technique, 
lndlquer  le  principe  et  lea  conditions  d'applicationa  das  clauses  ds  flabllltd 
,’arantle.  Nous  pourrona  enfin  examiner  les  principaux  resultata  que  cela  a 
permls  d 'obtenir  au  niveau  de  la  flabilitd  rdelle  des  dquipaments  et  de  1 'ana- 
lyse des  pannes  affectant  cetta  flabllitd. 

I - RSCUEIL  ET  EXPLOITATION  DES  FAIT5  T5C1WI3UES  - 

1.1.  Les  falts  techniques  . 

Lee  informations  concemant  I'exploitatlon  des  dquiperrents  dlectro- 
niquas  en  service  dans  l'Amde  de  l'Alr  sont  de  plus  en  plus  prises  cn 
compte  par  un  SyatAme  Automatlsd  d* In format ion  Terhnique  (SAIT).  Ce  sys- 
tems repxoupe  tous  les  *aits  Techniques  lntervenant  pendant  In  pdrlode 
d'exploltatlon  opdrationnelle  des  ayst&mes  mis  en  oeuvre  par  l'Armde  de 
l'Alr.  C'eet  done  le  syatArae  d'Infomatlon  permettant  de  connattra  les 
ddfalllance  des  dquipements  dlectroniquas.  On  dlt  qu'il  y a "Fait  Tech- 
nique" chaque  fois  qu'une  intervention  a lieu  sur  un  materiel,  A titrs 
correctif  ou  prdventif.  Les  informations  correspondantes  sont  recueil- 
lles  sur  un  document  de  base,  la  Piche  d'Intervention  Technique  (?IT). 
C’est  done  *rAce  A ce  document  de  baae  qu'il  est  possible  au  technicien 
de  connattra  les  informations  relatives  A la  flabilitd  rdelle  de  l'^qul- 
pement  auquel  11  s'lntdresse.  Ces  informations  sont  indlopensables  pour 
1 'amelioration  de  la  flablllte  de  l'dquipement  considdrd  j 11s  dormant 
^qalement  des  informations  indlspensables  pour  Je  nouvelles  generations 
d'Aqulpement.  Rous  allons  done  examiner  auccessivement  comment  s'effec- 
tuent  le  recuell,  le  traltement  et  I'exploitatlon  des 


Pnlto  Techniques,  pemettant  l’dtude  doa  pannea  en  fonctlonnement 
r^el. 


Auparavant,  il  faut  expliquer  davantage  ce  qu'on  appelle 
"Fnlta  Techniquee",  et  comment  eca  falto  techniques  aont  identi- 
fies et  classes. 

Pour  ce  qui  intdresse  le  dcmalne  de  la  fiabllitd,  on  appelle 
"Fait  Technique"  un  dvenement  qui  necennite  une  intervention  cor- 
rective pour  dlinlner  une  anonalie  constatde  dans  la  vie  d'un  ma- 
teriel et  pouvant  compromettre  soit  son  utilisation  (par  exenple 
pr -neuter  un  risque  au  plan  de  la  adcurltd),  ooit  oes  perform ancec 
(par  exe  pie,  rendre  le  materiel  incapable  de  remplir  sa  nionlon)! 
aolt  an  maintenance  ( par  exemple,  en  augnentant  lea  ch' rgea  de 
celle-cl). 

Le  felt  technique  est  idontlfid  de  la  faqon  aulvante  s 

. L'identlfication  precise  du  materiel  concern^, 

. 3n  localisation  exacte, 

’ La  nature  de  la  manifertation  (rupture  s derive  des 
performances  ; . . . ) 

, Sa  cause  (comporant  dcfalllnnt  ; defaut  de  fabrication  $ 
sa  cause  exterleure  j ...  ) 

. Ses  consdouenceo. 

Lea  felts  techniques  sont  nuoai  classes  par  leur  gravltd. 

On  distingue  3 niveaux  de  gravitd  * 

. Gravitd  1 s le  fait  technique  met  en  cause  la  adcuritd  dea  vole 
ou  des  personnels,  ou  a des  consdqu-nces  graves  au 
plan  opdrntlonnel. 

. Cravitd  2 i le  fait  technique  met  en  cause  la  disponibllite  des 
matdrlcla 

. Grnvitd  3 s on  regroupe  so 's  cette  rubrique  toua  lea  autreB  frits 
techniques  relntifs  k la  vie  ou  a la  maintenance  du 
matdriel,  et  dont  les  con3dquences  aont  noins  impor- 
tantesqu’au  niveau  1 et  2. 

.2.  Rccuell  des  falts  technlouea. 

Le  recueil  des  felts  tecliniquea  est  la  fonctlon  nui  con- 
oiste  en  la  saiaie  dea  informations  teclnlques  dldmentolres  au 
niveau  de  1 ’utilisateur,  Ce  recueil  a une  grande  importance  car, 
d<  lui,  dependent  1 'nboutlr ce rent  et  la  qualitd  des  dtudes  tech- 
nician, en  pnrticulier  en  mstidre  de  finbilitc,  par  l'nnnlyae 
qualitative  et  statlstique  des  defnillances,  F.n  pnrticulier,  il 
dolt  fitre  nyotemotique  et  precis. 

Ennuite,  par  exploitation  et  trniteent  ultericurs,  on 
dtnblira  des  informations  plus  dlabordes  (dtat3  d'analyse  et  de 
synthese)  a partlr  de  ces  foits  tecliniques  dlr'mentnires. 

Le  document  de  recueil  dea  faita  techniques  eat  la  FIT 
(r’iche  d * Intervention  Technique).  C’  st  un  imprlmd  format  stan- 
dard (21  x 20,7  cm)  present*?  sous  forme  de  llassc  de  4 fcullleta 


autocopiants,  qui  auront  chacun  un  destinataire  different  ; as 
particulier  un  da  cea  feuilleta  sera  adreaad  au  Centra  da  Calcul 
reaponaable  du  traltement  automatlque. 

La  FIT  comprend  2 parties  t 

. - partle  de  gmiche  i on  y trouve  dea  informations  dcritea  an  code, 
pour  8tre  raises  an  mAnoires  at  traltdes  automatiqueraent  comma  on 
la  verra  plus  loin.  Lae.  informations  comprennent  lea  elements 
auivants  t 

. date  ot  unit 4 opdrationnelle  concernde, 

. type  at  identification  de  l'adronef  support  de  l'dquipe- 
raent, 

. dquipement  concemd,  avec  identification  et  temps  da 
fonctionnement , 

. circonstances  da  l'avaria  (en  vol,  au  sol,  ...)  et  nature 
de  1 'intervention  (depose,  teat  automatlque,  ...) 

. constatations,  gravity,  consequences  pour  la  mission 
( annul ^e , retardde,  ...) 

. causes  de  la  ddfaillance. 

Cea  elements  sont  donnds  par  la  PIT  "initials''  Anise  par 
l'utllisateur  dks  l'apparition  de  l'anomnlie  ; quand  il  y a re- 
paration, la  reparnteur  etablit  une  FIT  *reponse*qui  dome,  an 
complement  des  informations  prdcddentes,  las  dldments  suivants  t 

. renseignenents  relatifa  k la  reparation,  par  exemple  > 
panne  imputable  ou  non  au  materiel, 

* nature  das  modifications  apporteas. 

- partis  da  drolte  i cetta  partie  "observation"  est  rdservde  k la 
description  detalliea  (non  codde)  dea  constatations  fait as,  dea 
recherchea  da  panne  effactuess,  dea  causea  preBumdea  de  la  panne, 
des  mesures  prises,  des  suggestions  ...  les  renselgnements  aont 
particulikrement  utiles  pour  une  etude  ulterieure  do  fiabilite 
par  analyse  des  defalllances. 

1.3.  Traltement  et  exploitation  des  falts  techniques. 

La  traltement  des  falts  techniques  est  de  plus  en  plus 
effectud  de  fagon  automatlque  k I'aide  de  calculateur.  II  a pour 
objet  la  centralisation,  la  nxise  en  memoire  et  le  tri  des  infor- 
mations techniques  recueillles  grSce  au  FIT  et  d'en  ddduire  das 
informations  plus  dlabor^es  aux  plans  techniques,  opArationnels 
et  logistiques.  Ces  informations  sont  regroup^es  dan3  diffdrents 
documents,  qui  peuvent  Stre  prriodiques  ou  dtabli3  k la  suite 
d'une  demande  particuli&re. 

Pour  ce  qui  concerne  la  fiabilitd,  deux  documents  (ou 
•dtats1)  sont  pricipolement  utilises  t 

. Etata  de  synthase 

Ils  sont  rftablls  salon  une  pdriodicitd  trimestrielle  ou 
annuelle.  Ils  donnent  une  vision  globale  de  la  fiabilitd  au 
niveau  d'un  s^stkme  d'armes  (avion  par  exemple).  Pour  chaque 
dquipement  ou  sous-ensemble  important,  on  trouve  j le  norabre 
d'heures  de  vol,  le  norabre  d'dquipements  en  fonctionnement,  le 
norabre  de  FIT  Anises  et  de  ddf alliances  confirmees,  le  UTBF 
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"apparent"  (relntifs  nux  heures  da  vol)  at  la  taux  da  ddfail- 
lance. 


MTBP  apparent 


nombre  d'hrurco  de  vol  x onnntltd  par  avion 
nombre  do  ddl'aillancea  confirmees  ” 


Ceo  /tats  eont  diffuses  & l'Etat-MeJor  at  aux  Services 
Techniquep,  pour  connaltre  la  fiabilitd  des  dquipements  sur  las 
diffdrents  adronefe.  Ilo  permettent  t 

. da  comparer  la  fiabilite  (KTBP)  daa  diffdrents  dqui- 
pementa  d'un  avion, 

. da  connaltre  Involution  avec  le  tempa  du  t'TBP  da 
chaque  dquipement. 


• State  d'analyse 

Poir  la  fiabilitd  at  l’analyee  dee  pannes  affectant  laa 
dquipements,  l'dtat  le  plus  conmundment  utllisd  eat  un  document 
intltuld  "CLASDEP"  ou  "dtat  da  clasaement  dea  ddfalllancea  par 
cause  da  panne".  Cat  dtat  regroups  dana  un  aeul  document  lea 
differentes  PIT  dmises  pour  un  dquipement  dorwd.  Pour  chaque 
dquipement,  ontrouva  done  dee  reneeignementa  aur  lea  constata- 
tlons  faites  at  la  (ou  las)  causes  de  la  panne  t ces  informa- 
tions ont  dtd  tiroes  dea  PIT  que  l'on  a ddcrites  prdcdderambnt . 

L'dtat  de  classenent  dea  ddfalllancea  par  cause  de  panne 
estutlllsd  par  lea  Services  Techniques,  en  liaison  avec  las  in- 
dustriela.pour  examiner  lea  circonctancea  des  avaries,  les  cau- 
ses de  ces  avarieset  determiner  les  elements  critiques  d'un  d- 
qulpement.  C'est  done  la  document  as  entiel  permettant  l'analyse 
des  pannes  en  exploitation  dea  dquipements  dlectroniques  de  bord. 
C'est  aussi  le  document  de  base  pour  1 'introduction  des  Clauses 
de  fiabilitd  garar.tie  dans  les  contrats. 

En  effet,  & l'nide  de  cet  dtat  d'analyse,  une  Comrnissi- 
on  composde  de  reprdeentanta  de  1'Etat-MaJor,  des  Services 
Techniques  et  de  l'industrlel  fabricant  l'dquipement,  examine 
lea  interventions  effectudes  et  determine  en  particuller  si  les 
pannes  eont  ou  non  imputables  A l'dquipement.  ConnaiBBant  par 
ailleurs  le  nombre  d'heures  de‘'VOl  des  avions  sur  lesquels  l'd- 
quipement  eat  montd  et  corapte  tenu  d'un  coefficient  heures  de 
vol  / heures  de  fonctiounemcnt,  il  eat  aisd  de  determiner  le 
MTBP  du  matdriel. 


2 - CLAUSES  CONTRACTUrLLES  DE  FIABILITE  - 

Le  Systferae  Automatique  d'Information  Technique,  partant  de  l'in- 
formation  dldmentaire  donnde  par  la  PIT,  aboutit  & des  informations 
dlabordee  consignees  dans  dea  Etats  de  aynthfese  et  d'analyse,  et  con- 
cernant  la  fiabilitd  en  exploitation  et  l'snalyse  des  pannes,  Gr&ce  & 
ces  informations,  11  a d td  possible  d'introduire  des  Clauses  de  fiabi- 
lltd  garantie  dana  dea  contrata  d 'achats  d ' dquipementa  dlectroniques 
de  bord.  Les  conditions  d'applicationB  de  ces  clauses  ont  dtd  l'occa- 
slon  d'analyser  flnement  lespaniies,  qualltativement  et  quantitative- 
ment,  apparaissant  en  exploitation  rdelle. 


2.1.  Principe  des  Clauses  de  flabllltd  garantie. 

Par  lea  Clauses  de  fiabllitd,  l'induatriel  fourniaaeur  de  l'^qui- 
pement  a 'engage  & obtenir  une  vnleur  H de  MTEP  en  exploitation  t6- 
elle  (par  example  N ■ 600  h pour  un  Tacan).  Cette  valeur  contrac- 
tuelle  eat  fixde  aprfes  discussion  entre  foumiBseur  et  client  ; 
elle  eat  aouvent  de  l'ordre  de  80  S de  la  valeur  obtenue  par  lei. 
cnlculs  pr^visionnels.  Parfois,  elle  eat  fixde  aprks  des  eBaaia 
de  fiabilit^  en  laborntoire. 

Dana  le  cas  on  la  valenr  contractuelle  N n'est  pao  obtenue 
en  fonctionnement  rkel  l'induatriel  doit  effectuer  gr- tultement 
toutea  lea  corrections  et  modifications  n^cessalres  pour  atteindre 
l'objectif,  sur  les  materiels  k livrer  et  ^galement  aur  ceux  d£jk 
livrds  | ces  modifications  ont  pour  but  de  rem^dier  aux  pannes 
syat&matiquea. 

D'autre  part,  si  ia  valeur  obtenue  r^ellement  est  inf^rieure 
k N - 201,  l'induatriel  s'engage  k effectuer  toutea  lea  reparations 
gratuitement  (pieces  de  rachonges  ; mains  d'oeuvre  ; deplacement..) 

Cette  garantle  de  1ITBF  est  assurle  en  principe  pour  5 ana 
k partir  de  la  livraison. 

2.2.  Conditions  d'appllcatlon. 

La  fiabllitd  de  l'^quipement  est  representee  par  son  MTBP  opera- 
tional. Ce  MTBP  operationnel  est  etabli  periidiouement  (tous  lea 
3 mole  en  principe)  k partir  dea  etats  d’ analyse  et  de  synthkse 
de  PIT,  sur  tous  les  4quipements  en  Bervice  du  type  cocaidere. 

Une  commiesion  de  apecialistea  composee  de  repreaentanta  des  uti- 
lisateura,du  Service  Technique  client  et  de  l'induatriel  foumis- 
seur,  retient  lee  pannea  directement  imputables  au  materiel  et 
etablit  le  MTBP  operationnel  pour  la  periode  conaid^rde. 

L'etablia  ement  du  MTBP  demande  la  connaiaeance  du  nombre 
de  pannea  et  du  nombres  d'heures  de  fonctionnement. 

Le  nombre  d'heures  de  fonctionnement  eBt  celui  realise 
par  tous  lea  dquipements  en  service.  II  est  lu  sur  des  compteurs 
horairea  j dans  le  cas  ok  il  n'y  a pas  de  compteur  horaire,  on 
determine  lea  hcures  de  fonctionnement  k partir  des  heurea  de  vol, 
par  application  d'un  coefficient  fixe  k priori,  et  qui  depend  du 
type  d'avion  et  du  type  d'enuipement  consider^. 

Les  pnnneB  prises  en  consideration  sont  celles  qui  sont 
imput- blea  au  materiel  { elles  englobent  toutes  les  anomalies  et 
fonctionnement 8 defectueux  qui  empSchent  l'equipement  d'avoir  dea 
performances  operationnelles  stisfalsantes  et  de  remplir  aa  miaaion, 

Les  pannes  imput-bles  comprennent  done  » 

• Les  defaillances  techniques  de  pikees  ou  composants,  n§me 
si  les  pieces  ou  coraposants  satisfont  aux  exigences  qui  leur  sont 
imposdes  par  le  dossier  de  fabrication. 

• Un  mauvais  fonctionnement  qnelconque  decelsble  au  banc 
d'essai,  dans  lea  con  ditions  extr§mes  d'utilisation  pr^vues  aux 
clauses  techniques  et  dont  la  cause  directe  est  intermittente  ou 
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inconnue, 

. La  ddfalllance  imputable  k plualeura  pieces  de  types  dif- 

fdrenta  qui  doit  fitre  considdrde  comma  constituent  plusieurs  dd- 
faillances,  ai  cheque  pifece  considdrde  sdpardment  empfiche  d’atte- 
lndre  lea  performances  eatisfaisentes.  En  revanche,  elle  doit 

fitre  considdrde  comma  one  ddfalllance  unique  si  cheque  pifcce  ne  I 

peut  k elle  aeule,  provoquer  la  ddfaillance  de  l^quipement  . I 

. Lea  ddfaillances  entralndes  par  une  mauvaise  conception, 

. Lea  ddfaillances  entralndes  par  une  fabrication  defectu- 

euae , 

. Lea  ddfeillancee  lraputablea  k tout  ddfaut  dea  rdglages 

effectuds  en  uoine. 

En  ,'evanche,  on  ne  retient  pas  pour  la  ddtermination  du  UT£F  t 

. Lea  fonctionnements  ddfectueuz  ou  anomalies  dfls  a dea 

erreura  de  manipulation,  k dea  procddda  de  contrfile,  de  reglage, 
d’ installation  non  conformes. 

. Lea  ddfaillancea  rdsultant  directement  d'une  autre  dd- 

falllance  ddjk  ddcomptde,  ai  ellea  apparaiaaent  event  un  ddlai  de 
50  heurea  aprks  la  premifere  ddfaillance. 


Le  UTBP  eat  garanti  dans  lee  conditions  d'utillaation 
auivantee  : 

. L'dquipement  ne  doit  paa  Itre  utiliad  de  fagon  continue 

dans  lea  conditions  climatiquea  extr&nea. 

. Lea  tensions  d'allmentation  et  les  tranBitoirea  ne  doivent 

paa  excdder  des  limitea  autorlades, 

. La  compdtence  du  personnel  effectuant  lea  opdrations  de 

ddtection  de  panne  et  d'dchange  de  aous-enaemblP  dolt  Itre  auffi- 
sante  pour  qu'il  xi'y  ait  ni  fausae  manoeuvre  ni  inaufriaance  dans 
le  travail  effectud. 

. Lea  compoeants  dont  la  durde  de  vie  arrive  k expiration 

doivent  8tre  reraplacda. 

2.3.  Rdeultata  obtenus. 

Cette  clause  de  fiabllitd  garantie  a ddjk  dtd  introduite 
dans  de  nombreux  contrats  d'achat  d'dqulpenenta de  radiocomnunica- 
tlon  ou  de  radionavigation.  L' experience  eat  encore  rdcente  et  on 
rencontre  quelquea  difficultds  au  niveau  d»  l’epplication.  71  y a 
pratiquement  deux  types  de  difficultds  : les  preaikrea  viennent 
du  fait  qu*il  est  tres  difficile  de  connaltre  le  nombre  exact 
d'heures  de  fonctlonnement  i par  exemple,  difficultd  de  relever 
dea  compteujs  horalres  uur  dea  dquipements  installda  au  fond  d'UDe 
soute,  problfeme  pour  noter  lea  heures  de  fonctlonnement  au  banc 
d’essai,  variation  eelon  les  types  d' avian  et  les  prcfils  de  mis- 
aion  ; les  eecondes  difficultds  viennent  du  fait  que,  lors  de  la 
discussion  entre  utillsateur  et  fournisseur  pour  aavoir  ai  une 
panne  eat  imputable  ou  non  k l’equlpoment,  certains  cas  lltigleux 


T 


sont  difficiles  & tranches  Mats  globalement  le  bila~  est  trfea  po- 
aitif  ; 11  aemble  en  particulier  que  l'intdressement  financier 
eat  un  argument  ddcisif  pour  senslbiliaer  lea  lnduatriela  aux  pro- 
blfemes  de  fiabilitd  ; de  plus,  1' analyse  tree  ddtaillde  qul  eat 
falte  pour  c ha que  panne  est  un  facteur  d' amelioration  de  la  fia- 
bilitd, tant  pour  l'dquipement  considdrd,  que  pour  de  future 
dqulpementa. 


2.4.  Maintenance  forfaltrire. 

Outre  cette  clause  de  fiabilitd  garantie  dont  on  vient 
d'expliquer  le  principe,  les  modalitds  d'applicationa  et  lea  re- 
sultats,  on  a essayd,  pour  d'autres  dquipenents,  d'introduire  une 
clause  dite  de  "maintenance  forfaitaire".  Le  principe  eat  de  fixer 
forfaitairement  le  montant  annuel  des  coflte  de  reparation  et  de 
maintenance  ; ce  montant  annuel  est  dtabli  en  fonction  d'un  coflt 
unit-.ire  de  reparation,  du  nombre  d'heures  de  fonctionnement  an- 
nuel et  du  MTBP  contractuel  . Si  le  MTBP  operationnel  eat  supd- 
rieur  au  i*. TE?  contractuel,  le  benefice  de  l'induatriel  est  aug- 
mented dans  le  caa  inverse^  bien  aflr,  il  est  penalise.  Ce  type  de 
clause  paralt  seduisant  car  il  allege  les  formalites  administra- 
tivea  et  est  stimulant  pour  obtenir  dea  efforts  en  vue  d'une  meil- 
leure  fiabilite.  Cependant,  ce  type  de  clause  en  eat  encore  an 
stade  de  tentative  preiiminaire  et  nous  ne  diapoaona  pas  encore 
d' experience  suffisente  pour  Juger  de  son  intdrSt  rdel,  de  sea 
rdsultat3  et  de  sea  difficultes  d' application. 


ANALYSE  DES  PANNES  EH  EXPLOIT LTIOK  HELLB  - 

Comme  on  vient  de  le  voir,  les  clauses  de  fiabilite  ga- 
rantie ont  dte  jusqu'a  present  aurtout  a pliqudes  dans  les  contrats 
d' achat  d* dquipenents  de  radionavigation  et  de  radio commini cation 
(TACAN,  VOR-ILS,  Enetteur-rdcepteur  V/UilP,  Marker,  ...) 

CrSce  a l'analyse  dea  Etats  d'analyse  de  defaillances  et 
de  leur  examen  lor3  des  reunions  de  la  Commission  de  spdcialistes^il 
eat  possible  de  beaucoup  mieux  connaltre  les  types  de  pannes  affectant 
la  fiabilitd  des  equipcnent3  electroniques  de  bord. 

11  faut  done  revenir  sur  la  notion  de  panne.  Pour  Ctre 
prise  en  compte  pour  la  determination  du  ;.;TBP,  la  panne  doit  avoir  dte 
ddtectec  chea  1 ’utilisateur  et  entrainer  une  intervention  : ce  premier 
point  aboutit,  comme  on  l’a  vu,  a l’dtablissement  d'une  PIT.  Ensuite, 
elle  doit  Strc  imputrble  au  materiel  s e'est  le  travail  de  la  commis- 
sion le  apd' ialistes.  On  distingue  done  pannes  "imputables  " et  panneo 
"non  imputables".  Seules  les  premieres  sont  retenuea  pour  le  calcul  du 
"i’SP. 


3.1  Pannes  non  imputables  & l'eoulpenent. 

On  peut  avoir  une  panne  non  imputable  a 1 ' equipement  con- 
sidere  lorsqu'elle  est  provoqude  par  d'autrea  equipements  ; e'est 
un  probleme  d' interface,  et  on  a rencontrd  effectivement  quelque3 
cas  ou  la  panne  d'un  equipement  peut  entrainer  celle  d'un  autre 
equipement. 
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Maio,  le  plus  souvent,  lea  pannes  non  imputables  sont 
diles  & des  conditions  anormales  d'utilisations  ; problfeme  d'ali- 
mentation  dlectrique  ; temperature  anormalement  dlevde  } condi- 
tions de  vibrations  ne  correspondent  pas  au  profil  theorique  de- 
crit  dans  lea  specifications,  ...  On  peut  citer  un  exemple  parti- 
culier  : & la  suite  de  litige  sur  la  temperature  de  fonctionnement, 
on  a pris  lc.  mesure  sulvante  s des  pastilles  "Thermocolor"  ont  etd 
fixdes  & certains  endroits  de  l'equipement  ; on  a ainsi  constate 
que  la  temperature  relevee  etait  supdrieure  a ce  qui  etait  spdci- 
fid  ; en  consequence,  les  pannes  correspondantes  n'ont  pas  ete  im- 
putees  k l'equipement. 

II  exists  aussi  des  interventions  techniques  signaldes 
par  les  PIT  qui  ne  sont  pas  retenues  dans  le  c«lcul  du  MTBP  car 
elles  sont  afles  & des  erreurs  humaines  de  manipulation,  soit  au 
niveau  de  l'emploi  operationnel,  soit  au  niveau  de  1' installation 
ou  de  la  maintenance. 

3.2.  Pannes  imputables  au  materiel. 

Ce  sont  bien  sur  les  plus  nombreuses  et  celles  qui  nous 
intdressent  ici.  Le  systdme  Automatique  d' Information  Technique 
que  nous  avons  ddcrit  est  un  puissant  outil  d' analyse  et  de  Byn- 
thdse  pour  une  meilleure  connaissance  de  la  fiabilitd  et  l'examen 
des  pannes  qui  l'affectent.  De  nombreuses  dtudes  statistiques  sont 
possibles.  On  ne  donnera  ici  que  quelques  exemples  illustratifs. 

Par  exemple,  il  est  toujours  intdressant  de  connaltre 
les  statistiques  dormant  l'origine  des  pannes.  On  e trouve  ainsi, 
pour  un  dmetteur-rdcepteur  s 

. 78  % des  pannes  proviennent  de  composants  defectueux. 

. 17  £ des  pannes  proviennent  de  ddfauts  de  fabrication 
ou  de  conception. 

. 5 % des  pannes  proviennent  de  derdglage. 

On  peut  dgalement  obtenir  unerdpartition  plus  fine  des 
ddfaillances.  Sur  un  autre  dquipement  on  a constatd  la  rdpartition 
suivante  : 

- 56  % des  pannes  sont  dfles  & des  composants 
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15 
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26 
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& d'autres  composants 

- 30  % des  pannes  sont  dfles  & la  fabrication 

. 47  pannes  dfles  h soudures 

. 34  " " & des  contacts 

• 20  " ” h deB  courts-clrcuits 

. 30  " " aux  cablages 

- 14  % des  pannes  sont  dQes  h des  ddrdglages. 
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L'eiploitatlon  dea  faita  techniuea,  evec  ce  quelle  donne 
pour  la  conr.al snance  dc'talllee  dea  pannea  affectant  la  fiabllltd, 
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dcvel  oppe-icnt  et  la  fabrication  des  clqulpemento  future. 
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!!n  systme  <’  'information  donnant  une  connuisnar.ee  .-lobu- 
le et  anxlytique  de  li  fiabllite  en  exploitation  cat  un  outil  Indis- 
pensable de  prciotlon  de  la  qualite.  II  per  et  1 'Introduction  'e  clau- 
ses de  fiat  illtc  garantle,  .'lur.e.ut  decislf  pour  lntrrt  finer  lc  fourris- 
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- a niveau  furicution  1 oubli  de  la  fiat illtc  pour  di-lruer  le  prix  j 
1 rsuf  ft  ft  tnre  du  pr  a ,ru".ne  de  fiabllite  | diff*r-nto  fact  euro  hu  tnln3. 
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It  is  now  a proven  fact  that  the-  development  of  high  reliability  equipment 
dt  mends  efforts  at  all  the  stager,  of  tin  equipment  Ufa  project  design  and  defini- 
tion, manulae  t urine  of  the  material  .»,»«  rational  use.  However,  tu;  h < ffo:  tf.  nur.t 
r.ot  be  made  repaiate’y,  U3  thtlr  icsultr,  have  to  be  known  ; in  order  word-,,  the 
system  must  operate  on  a clortd-loop  birds.  The’,  tfore,  means  of  dc-te-i  nlnl.ig  the 
a tual  reliability  of  a system  under  operational  condition;',  and  of  de-tee  tin,  the 
failures  affecting,  reliability  have-  to  be  Implemented.  buch  me... no  are  lndi  spi-n-able 
to  improve  tier  r eliability  of  the  equipment  consitlered  ; the  y also  pr  ovide  Infer  ra- 
tlon  whl.h  1"  lndi - pi  usable  to  develop  new  generation:  of  « quipm<  r.t. 

Within  the.,  Prene.h  Air  tore  an  Automatic  by:  t«  m of  X'ctuii.Bl  Information 
(Trench  acronym  : -AIT)  has  been  se  t up,  and  a boric  do  ur:,«nt,  the  Technical  Action 

form  (Trench  acronym  : FIT)  Is  drawn  up  evert  time-  retry  failure-  or  anomaly  is  ofc-  e rv- 

ed  when  an  equipment  i - be  in-,  u-ed.  Amonq  other  appl  1 ra  1 1 or.s , this.  inf-::  mat'  on 
ryrte  n his  permitted  th*  introduction  of  guaranteed  r.  li ability  clauses  into  a num- 
ber of  , u,tr:j,  tc.  far  the  put  -hi..*  of  airlnne  avionic  t equips*  nbs.  The  urtpl  U a t i 
f f rU'li  r 1 reuse, r.  provided  an  excellent  opportunity  for  analysing  actual  r.  li'bility 
during  the  operation  cf  f juipme  r t;  . 

i'b.Ir  out  r.rati  - system  of  t-vhr.iral  infoimtle-n  will  be  described,  ar.d  the 
prtii.  Iple  a. id  • rendition?  of  appl  icat  .on  cf  guai  ante *>  1 re  llab.l  t t.y  lau.  e : ,111  t< 

11  -.arced,  i tn.l1  lv  the  main  : e rul  tf  < It- in*  ei  thr'Ju.h  this  ryrte  a a:  repar.'.:  * r . 

a-  tual  : --l  lability  of  equipment  and  *1>  in  >ly:  tc  of  the  failures  affe  t.rn  : ...  ; ,- 

tility,  will  be  reviewed. 

. Ce-L^stl  1 e,'ii , iceAelulu  A..D  0, .Liam  1 uh  ur*  T.- - I C. I .AD  -*  A .... 

l.t.  T.  -hni  il  F*.  t 

The  handling  oT  inform.-,  ion  on  the  utilisation  of  el.  ;t*  ni  v-juipme  r.ts 
within  the  ;.ir  T'i-.-e  i-  more  and  ckt,  fr»  ju»  ntly  < r .rusted  t t.  ,.ut  sr.t.e  . y.-tem 
o.  Technical  Infstm  -tion  ( .'.If'1.  The.  ryrt,-.  c .1 1 • 1 1 - rid  -nti  -I.  • ill  th* 
Technical  ract.d  occurring  durin  the  ei'-l  :e  life  of  the  -y-te-s  u -e  d by  tin  At* 
Force.  This  is  therefore  the  Inform  'tion  Cysten  th:  ou.  h •..•hi  :h  the  failure.-  - r 
electronic  equipments  err.  be  knoii. 

A te ..  fmi.al  Tact  1 r said  to  tale  plow  eve:/  tim*-  i : e t : -a  a:  ;. . - 
ventive  action  i:  ..allied  out  cn  a pie.:,  of  equipment.  The  so:  r e pond  in.;  ir.f-'r s.  .tion 
is  recoidt-a  on  a basic  document,  the  T-  ihnlcal  Action  Font  (TIT).  It  is  t>.« • ' 're 
this  basic  dooun.-nt  which  supplies  to  the  technician  the  information  relative  to 
the  actual  reliability  of  the  equipment  with  which  he  is  cor., erne d.  we  will  . xamine 
successively  how  Te clinical  Tacts  are  collected,  processed  and  used,  thus  making  it 
possible  to  investigate,  failures  occur  ring  in  the  e.ou”ce  of  actual  oneration. 

First  of  all,  the  abo\ e mentioned  "Teclnical  Facts"  should  be  defined 
with  more  accu.acv,  as  well  es  the  methods  used  for  their  identification  and  filing. 

In  the.  field  of  reliability,  we  call  a "Technical  ract"  an  event  whim 
requires,  corrective  action  to  eliminate  an  anomaly  observed  dut  in_,  the  service  lift 
of  a piece  of  (’equipment  and  likely  to  impair  either  its  use’  (for  instance  by  endanger 
ing  its  cafe  tv),  or  its  pe  rform-mce  (for  instance  by  making  the  equipment  ur.suited 
to  its  mission),  or  its  r.a in  t emu  cr  (for  instance  by  increasing  the  workload  involv- 
ed'. 


A t-  • hnical  fact  is  identified  according  to  the-  following  process  : 

. A-cu  'ate  identification  of  the  equipment  concerned 

. Debt  rnih  ’tion  of  its  exact  location 

. [lieu,  e of  th'  breakdown  (fracture,  performance  v.irirt.  n,  etc.) 

. Its  cause  (d-f’-tt'-r  com;  oi„  nt  ; mreuf...,  luring  defe.  t : e xt»  rn-1  -.  -us.  , 

. Its  consequences 

Te- hnical  facts  al-c  e-ltr*  s •'  f i»-»  . reeding  tc  v;*  1 1 lev,;  af  rev.  rity  : 

. 'rt  level  of  reverit.,  : t*  • t.  hni  •!  f.-.t  e nd..ig,c  r.  flight  ;r  : s snr."  1 

r.rity,  '-.i  ir  attrn.le-d  by  rot  i'-uc  e-pe  r a t i an  >1 

n • -,u  n-.t-s. 

. and  1*  *1  of  * ve  i it y : the  te  lirii-al  fact  imp.  : ,1a  the  a"  i i l..b i 1 1 1 y 

>:  ',  tr  • ;ul,rrnnt, 

. 3rd  level  of  severity  : this  level  in,  ludef  ’ll'  the  it).,  • t*  thr.i  el 

fa  .tr  rt  l.i  t e.  d to  th  11  -r  ! n • r n er.  - of 

< qulp.it  nt,  and  v.hose  cons*  qu*  n is  ..:  < Irr 

inportant  than  th  or,  c,f  I . v 'r  ' mil  i. 
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...  C > 1 I • 1 1 hi  of  TvluiU.il  . icts. 

'>11'  -tin;  ti  ■ Iml  .1'  1 1 tr.  conr.lr.ts  In  He.qulring  1 1*  ra**ntury  technical 
■ r 1 1 ' — i t i 'ii  ; i .,n  u i : ..ij  h ■ t • t i ;cll-  t l«>n  Is  t ur.»  ntl  »'  Tor  tin  achieve  imt 

i-i  1 ;u  v 1 . t v of  tv. Knl  a 5 studies.,  • ,jh  c tally  .»•  far  us  i elioblllty  lr.  concerned, 

> It.  p't-nlt  ipi  .1  l l it  l vi  *nd  . t it  l stir.  al  failure  analyse  It  r.hovjld,  above  all, 
l'v  ; tv::utlv  .Old  a.  v Ui  ite. 

Tl.v  • ut-  . vu.nt  handlin'-  nwj  re-du  tlon  of  the  data  derived  from  these 
• I . r • .it  v t.v  luil. al  fa.  tr,  1 * .a  1 1 . to  mire  • laborat*-  information  (analysis  ar.d 

.'.vnt  I •‘•is  t i'pvir  t . 1 . 

T'v  ,1  i.  uii  nt  used  for  tie  collection  of  technical  facts  in  the  FIT 
v Tf  tail  'I  A ttm.  .■  . m',  ; t it  till  cl.-c  pr'nte-1  foin  (ft  x f'y.7  cn)  include  s 

a 'u'  v.vvt.,  vlii  i'.  1 . .it  1 >n  . -In  *ts,  each  n*  ant.  f >r  a different  addressee  ; one  of  these 
t a will  be  f ••  w i:\lv  d to  tie  Cot,  put  it  pin  C<  ntl  e In  char  gt  of  automatic  data 
11  • 

Tie  FIT  1 > imposed  of  two  p.  . tr.  : 

- ". y ff  I in  1 r . ; t : tr.;.  t contain.;  voJid  information  to  be  stor  ed  and 
...t  -i«ti  ,:■).!  :•  .•  .1 , u..  will  b-  * xplalned  fur  th*.  r on.  This  infor- 

•..■tijn  m iuies  tie-  iullawiiiu  items  : 

. aati  an  1 operational  unit  concerned 

. t’pv  and  i If  tit . float  lor.  of  the  aircraft  on  board  of  which  the 
e i 1 i ;i  1.  lit  is  u .•  d 

. * p.ii.oent  in  lined,  with  Identification  and  time  »r,  service- 

. ,ii  ;unr.tvin:cs  cf  thv  dur.a^i  (in  flight,  on  the  ground,  ...)  and 
typi  if  action  taken  (removal,  automatic  test,  etc.) 

. fa  ts  observe  1,  severity,  consequences  for  the  mission  (cancell- 
e|,  t p ore  d , a t • . ) 

. .;.u  <c  of  the  failure 

Tie  at  uvr  dot  . are  provided  by  the  ir..tlal  FI?  filled  in  by  ttie 
i;rc:  a.:  ..am  ’v.i  u ini-.r."  is  ibcrvid  ; whin  repairs  ere  carried  out,  the  repairer 
p.  , :!>b  a •'■ply  t IT  whi-h,  as  u .implement  to  the  preceding  iniorr.ation,  gives 
the  f jl  1 .•  in0  data  : 


. Information  un  the  repair  carried  out,  for  instance  : failure 
aac  rib-able  or  not  to  the  equipment 

. nature  of  nod i 1 icat ions  made 

” "■  d-t  han  i part  : This  section,  entitled  "remarks",  Is  reserved  for 
t.h."  .i<fu:li  1 iie;;.„riptlon  (uncoded)  of  the  farts  observed,  the  trouble 
. r.  )0*  in,  .arried  ju*.,  the  assumed  ciusec  of  the  failure,  the  measures 
taken,  tip  ru,juesti oi.s  mad'  , etc.  This,  information  is  extremely  useful 
f- : a . at-  i-  iu  r.t  reliability  Investigation  with  failure  analysis, 

' . J.  Fro.,  .sin.,,  and  Analysis  of  Technical  Facts 

?*>  hni  :al  fact.:  ,i aor*  1 more  frequently  computer  processed.  The 
ptirpo.  • of  :u.h  pi  ore . is  in,,  is  ts  v iilire,  store  and  sort  out  the  technical  data 
il'.'  ted  th:  au,;h  th*  t IT's,  tl  e n to  derive  from  iher.e  more  elaborate  technical, 
op.  : iCiorv.'i  itri  loyir.t  1 data.  These  data  are  in  turn  recorded  in  several  documents 
•ehi  .h  hi  publish  <1  either  pi  rioJi  ally  or  at  specific  requests. 

in  tin  ft-  11  .of  r ♦ liability,  two  documents  (or  "reports")  are  essentially 

u.  • J : 

. byn.hirls  j • ports 

T <•'•,»-  u e piep  -n  5 i vn-  term  or  every  ’'ear.  They  provide  a general 
ruiviy  of  tte  reliability  if  a weapon  system  (aircraft.,  for  instance). 

Tl. e Items  listed  fi.  each  miln  equli-ment  o’  sub-unit  are  : number  of 
flvitit,  hors.,  number  of  equipments  in  operation,  number  of  FIT’S  produced 
ml  if  confirmed  failur  es,  "appa:  e-r.t"  I'.TTF  (with  regard  to  flying  hours.) 

• ell  I ill  lure  r ate  . 

number  of  f.ying  hours  x number  of  device  per  aircraft 
apparent  KTBF  — — — — — — — ■ ■■  — — 

number  of  failure's  confirmed 

Vhr.r  ;e  ports  are  circulated  to  the  General  btaff  and  the  Technical 
Department*-,  in  order  to  determine  the  re-liability  of  equipments  on  the 
various  aircraft.  They  provide  the  means  of  : 


5-15 


. comparing  the  reliability  (MTBF)  of  the  various  equipments  of 
an  aircraft 

. Knowing  the  development  of  the  MTBF  as  a function  of  time  for 
each  equipment 

. Analysis  reports 

As  regards  reliability,  and  the  analysis  of  failures  affecting 
the  equipments,  the  most  commonly  used  report  is  a document  entitled 
"CLALDLF"  (acronym  for  the  French  phrase  : report  on  classification  of 
failures  according  to  their  causes).  For  each  equipment,  information 
is  provided  on  the  observations  made  and  the  cause(s)  of  the  failure  ; 
this  information  is  extracted  from  the  FIT'S  described  above. 

The  report  on  the  classification  of  failures  according  to  their 
causes  is  used  by  Technical  Departments,  in  coordination  with  industrial 
firms,  to  Investigate  the  circumstances  and  causes  of  damages  and  iden- 
tify the  critical  elements  in  an  equipment.  It  is  therefore  the  essential 
document  used  as  a basis  for  the  analyses  of  airborne  avionic  equipment 
failures  occurring  in  the  course  of  operation,  as  well  as  for  the 
introduction  of  guaranteed  reliability  Clauses  into  contracts. 

As  a matter  of  fact,  with  the  help  of  this  analysis  report,  a 
Commute*,  consisting  of  representatives  from  the  General  Ctuff  and  the 
Technical  Departments,  and  of  the  equipment  manufacturer,  considers 
ull  the  action  taken  and  decl  .s  whether  the  failures  are,  or  are  not, 
uscribablc  to  the  equipment.  , owing  the  number  of  flying  hours  of  the 
aircraft  or.  which  the  equipment  is  installed,  and  taking  into  account 
;»  flying  hours/hours  in  service  coefficient,  it  is  easy  to  determine 
the  .vTBF  of  the  equipment. 

2.  k-LI ABILITY  CONTRACT  CLAUSLC 

Starting  from  the  elementary  information  provided  by  the  FIT,  the  Automatic 
_ystem  of  Technical  Information  leads  to  elaborate  Information  recorded  in  the 
synthesis  and  -analysis  reports  and  dealing,  with  reliability  in  service  and  failure 
an. lysis.  Cuch  information  permitted  the  introduction  of  guaranteed  reliability 
clou:  s into  contracts  for  the  purchase  of  airborne  avionic  equipments.  The  condi- 
tions of  application  of  these  clauses  provided  the  opportunity  of  carefully  analyz- 
ing failures  occurring  in  service,  from  both  qualitative  and  quantitative  stand- 
ee Intr . 


2.1.  F !i... tyle  of  guaranteed  reliability  Clauses 

Thr ou ..h  reliability  clauses,  the  equipment  manufacturer  undertakes  to 
achieve  a value  N of  MTBF  in  actual  service  (for  instance,  li  » 500  hours  for  a 
"Ta-un"),  This  contractual  value  is  set  after  an  agreement  between  the  supplier 
and  the  customer  ; it  is  often  approximately  60  of  the  value  obtained  by  predict- 
ion calculations.  Sometimes  it  is  set  on  the  basis  of  reliability  tests  carried 
out  in  laboratory. 

If  the  contractual  value  II  is  not  obtained  in  actual  operation,  it  falls 
on  the  manufacturer  to  carry  out,  free  of  charge,  all  the  corrections  and  modifi- 
cations necessary  to  reach  the  objective  set,  both  on  the  equipment  to  be  delivered 
and  on  that  already  delivered  ; the  purpose  of  such  modifications  is  to  remedy 
systematic  failures. 

Besides,  should  the  value-  actually  obtained  be  lower  than  11  - 20  , 

the  manufacturer  must  undertake  to  carry  out  all  repairs  free  of  charge  (spare- 
parts,  man-power,  travelling-;,  etc.). 

As  a rule,  this  MTBF  guarantee  covers  5 years  from  the  date  of  delivery. 

2.2.  Conditions  of  Application 


r presented  by  its  operational  MTBF.  This 
*.Iy  (as  a rule,  every  three  months)  on 
■ oports,  for  all  the  equipments  of  the 
A specialists*  committee  including  represen- 
Tcchnlcal  Service,  and  the  supplier,  de- 
tod  considered,  on  the  basis  of  the  fai- 
- tal . 

necessary  to  know  the  number  of  failures 


The  equipment  relie.bi  i*- 
oj >e rational  MTBF  Is  determined  ;v*i 
tnc  basis  of  FIT  synthesis  and  m 
type  considered  which  art  in  : 
t.tives  of  the  users,  from  th- 
te-rmines  the  operational  I.TDi- 
lures  dirc'ctly  attributable  t 
To  determine  the  .IT', 
and  of  hours  in  service. 

The  numb* r of  hours  ...  service  is  that  covered  by  all  the  equipments 
In  service.  It  Is  given  by  a time  meter  ; when  there  is  none,  hours  in  service 
art*  dett.rain-.d  from  flying  hours,  by  applying  a coefficient  set  a priori,  which 
depends  bn  the  type  of  aircraft  and  equipment  considered. 
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The  failures  which  are  taken  into  account  a;  o those  aseribublo  to  the 
c -ip merit s . Tt.i  y include  all  the  anomalies  and  nalfun  lion-,  which  prevent  the 
equip1*!*  n t iron  achieving  a call  hictorv  operational  performance  and  fulfilling 

i 1 n i r r.  I on . 

T..i  n foi",  sur.li  failure 3 Include  : 

. Tart  or  ronpon* nt  futlurcs,  even  if  parts  and  compon*:its  meet  the 
requl r*  me nts  foinulat’  d in  th*  :.r..nu‘  octurlng  specifications. 

. Any  nal functioning  deter. tab!*  on  a test  bench,  under  the  extreme 
conditions  of  use  provided  for  by  the  technical  clauses,  and  whose 
diiect  cause  is  either  intei mittent  or  unknown. 

. /allured  aso. ibable  to  s* veral  pat ts  of  different  types,  which  should 
be  regarded  as  constituting  several  failures  if  the  part,  considered 
indiviudally , creates  an  obstacle  to  satisfactory  performance.  On  the 
contiaiy,  it  should  be  regarded  as  a single  failuic  if  each  part, 
considered  separately,  cannot  bring  about  a failure  of  the  whole 
equipment  : 

. Failures  induced  by  defective  design. 

. Failures  indue* d by  defective  manufacturing. 

. Failures  ascribable  to  any  error  in  the  adjustment.-,  ca:  ; led  out  ••ithin 
the  plant,  however,  the  following  defects  are  not  tal.*:n  into  account 
when  determining  the  I.TBF  : 

. !ialfunstionln._.  or  anomalies  caused  by  hardlinb  triors,  or  incorrect 
checking,  ad jus Lm* nt  o*  setting  up  p; ocodures, 

. Failures  resulting  directly  from  another  failure  already  taken  into 
account,  even  if  they  take  place  within  50  hours  following  the  first 
failure . 


The  i-.TBF  is  guaranteed  under  the  following  conditions  of  use  : 

, The  equipment  must  not  be  used  continuously  under  extreme  climatic 
conditions . 

. Power  supply  voltages  and  transitory  phenomena  must  not  exceed  the 
authorized  limits. 

The  personnel  in  charge  of  trouble  shooting  and  sub-unit  replacements 
must  be  competent  enough  to  avoid  wrong  moves  and  to  perform  satisfactory  work. 

The  components  whose  service  life  comes  to  an  end  must  be  replaced. 

i..j.  Hesults  Obtained 

This  guaranteed  reliability  clause  has  already  been  introduced  into 
many  contracts  covering  the  purchase  of  radiotransnlsslon  or  radlor.avlgation 
equipment.  However,  such  experience  is  still  recent,  and  a few  difficulties  are 
encountered  us  regards  details  of  application  j some  of  them  result  from  the  fact 
that  it  is  very  difficult  to  know  the  exact  number  of  hours  in  service  : for  ins- 
tance, difficult  reading  of  time  meters  on  equipments  located  at  the  bottom  of  a 
cargo-compartment,  problems  involved  in  recording  hours  of  operation  on  a test 
bench,  variation  with  aircraft  types  and  mission  profiles.  Other  difficulties  arise 
from  the  fact  that  when  a user  and  a supplier  argue  to  determine  if  a failure  is, 
or  is  not  to  be  ascribed  to  the  equipment,  some  disputable  cases  are  difficult  to 
settle.  However,  on  the  whole,  results  a’-e  very  positive  ; financial  involvement, 
in  particular,  seems  to  be  a decisive  argument  in  increasing  manufacturers'  concern 
for  reliability  problems  ; besides,  the  extremely  detailed  analysis  which  is 
performed  for  each  failure  contributes  to  improving  reliability,  as  regards  the 
equipment  considered  as  well  as  future  equipment. 

Z.k.  Contractual  Maintenance 

Besides  the  guaranteed  reliability  clause  whose  principle,  methods  of 
application  and  results  have  Just  been  presented,  attempts  have  been  made  to 
Introduce  a so  called  "contractual  maintenance"  clause  for  other  equipment.  Its 
principle  consists  in  setting,  by  contract,  the  yearly  amount  of  repair  and  main- 
tenance costs  ; this  yearly  amount  is  determined  on  the  basis  of  the  unit-price 
of  repairs,  of  the  yearly  number  of  hours  of  operation,  and  of  the  contractual  KTBF 
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If  tht'  operational  MTBF  is  higher  than  the  contractual  MTBF,  the  manufacturer's 
benefit  is  increased  ; on  the  contrary,  should  the  reverse  be  true,  the  manufac- 
turer is  penalized.  This  type  of  clause  seems  attractive  as  it  reduces  administra- 
tive procedures  ar.d  stimulates  efforts  to  achieve-  higher  reliability.  However, 
this  type  of  clause  is  still  at  the  preliminary  and  tentative  stage,  and  we  have 
net  yet.  acquired  sufficient  experience  to  appreciate  its  real  value,  its  results 
and  the  difficulties  Involved  in  its  application. 

3.  FAILURE  ANALYSIS  IN  ACTUAL  SERVICE 

As  stated  above,  up  to  now  guaranteed  reliability  clauses  have  been  applied 
essentially  to  contracts  for  the  purchase  of  radionavigation  and  radiotransmission 
equipments  (TACAN,  VOK-ILS,  V/UHF  transmitter-receiver,  Marker,  etc.). 

Through  the  analysis  of  failure  analysis  Reports  and  their  discussion  at  the 
meetings  of  the  Speciallsts'Commlttee,  it  is  now  possible  to  get  better  acquainted 
with  the  types  of  failures  affecting  the  reliability  of  airborne  avionic  equipments. 

Here,  the  notion  of  failure  should  be  further  specified.  In  order  to  be  taken 
into  account  for  determining  the  MTBF,  the  failure  must  have  been  detected  at  the 
user's  and  must  require  action  ; as  mentioned  previously,  this  first  step  leads 
to  the  drawing  up  of  a FIT.  Then,  the  failure  must  be  ascribable  to  the  components  ; 
this  decision  rests  on  th-.  Specialists 'Committee.  Thus  "ascribable"  failures  are 
differentiated  from  "non  ascribable"  ones.  Only  the  first  group  of  failures  is 
taken  into  account  for  the  calculation  of  the  MTBF. 

3.1.  Failures  non  ascribable  to  the  equipment 

A failure  is  not  ascribed  to  the  equipment  considered  when  it  is  created 
by  other  equipment  ; this  is  an  Interface  problem,  ana  there  have  been  a few  cases 
when  the  failure  of  a given  equipment  could  involve  that  of  another  equipment. 

However,  most  frequently,  non  ascribable  failures  are  due  to  abnormal 
conditions  of  use  : power  supply  problem  ; abnormally  high  temperature  ; vibration 
conditions  deviating  from  the  rated  profile  described  in  the  specifications,  etc. 

A particular  example  can  be  quoted  here  : following  a dispute  on  the  operating 
temperature,  the  following  action  was  taken  : "themocolor"  patches  were  fixed 
on  to  some  coin's  of  the  equipment,  and  it  was  possible  to  verify  that  the  tem- 
perature recorded  exceeded  the  specified  temperature  ; consequently,  the  corres- 
ponding failures  w re  not  attributed  to  the  equipment. 

There  art  also  some  types  of  technical  action,  reported  by  the  FIT'S, 
which  are  not  taken  into  account  when  calculating  the  MTBF,  as  they  result  from 
human  errors  in  handling,  either  in  the  field  of  operational  use,  or  in  the  setting 
up  and  maintenance. 

3.2.  Failures  aroribable  to  the  equipment 

These  failuies,  the  most  frequent  ones  of  course,  are  those  with  which 
we  are  concerned  here.  The  Automatic  System  of  Technical  Information  described 
previously  is  an  extremely  valuable  analysis  3nd  synthesis  tool  for  getting  a 
better  insight  into  reliability  and  a better  understanding  of  the  failures  which 
affect  it.  Many  statistical  studies  can  be  carried  out.  Only  a few  examples  will 
be  given  here  for  illustration  purposes. 

For  instance,  it  is  always  interesting  to  know  the  statistics  regarding 
the  origins  of  failures.  For  a transmitter-sender,  the  findings  are  as  follows  : 

. 70  of  failures  result  from  defective  components. 

. 17  of  failures  result  from  design  or  manufacturing  defects. 

. 5 '»  of  failures  are  due  to  maladjustments. 

A more  accurate  distribution  of  failures  can  also  be  obtained.  On  another 
equipment,  the  following  distribution  was  found  out  : 

. 5 C of  failures  are  attributable  to  components. 

. 8 failures  due  to  integrated  circuits 

. 121  failures  due  to  transistors  and  diodes 
. 18  failures  due  to  quartz 

. 13  failures  due  to  inductance  coils 

. 47  failures  due  to  capacitors 

. 15  failuies  due  to  resistances  and  potentiometers 

. 26  failures  due  to  other  components 
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.30  5t  of  failures  are  attributable  to  faulty  manufacturing 

. 47  failures  due  to  welding 

. 34  failures  uue  to  contacts 

, 20  failures  due  to  short  circuits 

. 30  failures  due  to  wiring 

.14  W of  failures  are  attributable  to  maladjustments 

It  is  interesting  to  note  - and  this  is  a rather  general  fact  - that 
a certain  stability  can  be  obst  rved  in  the  distribution  of  failure  sources  among  : 
components,  manufacturing,  maladjustments. 

It  is  also  possible  to  determine  the  failure  distribution  among  the 
sub-units  of  an  equipment  ; the  following  distribution  was  found  for  a V/UHF 
transmitter/receiver  : 

. 22  mechanical  frame 

. 13  5-  frequency  source 

. 29  % transmitting  unit 

. 3 S transposition  oscillator 

. 6 modulation  preamplifier 

. 4 h receiving  unit 

. 13S  low-frequency  unit  and  silencer 

. 6 varicap  control 

. 4 >.  power  supply 

In  view  of  these  results,  special  .attention  was  devoted  to  the  trans- 
mitting unit  in  which  a transistor  caused  iC  of  the  overall  failures. 

As  it  provides  the  means  of  getting  at  a detailed  knowledge  of  failures 
affecting  reliability,  the  analysis  of  technical  facts  has  proved  to  be  of  consi- 
derable interest.  Apart  from  its  prirary  purpose,  which  v,-ar  tht  checking  of 
controlled  reliability  clauses,  it  offers  advantages  from  the  following  viewpoints 
it.  leads  to  a better  knowledge  of  real  use  and  environmental  conditions,  and, 
consequently,  makes  it  possible  to  eliminate  anomalies  ; it  reveals  repeated 
failures,  particularly  critical  modules,  defective  components,  design  or  manufac- 
turing defects  and  therefore  provides  the  means  or  improving  reliability  by- 
applying  appropriate  remedies.  B sides,  it  supplies  a large  amount  of  information 
which  can  b'  used  fruitfully  for  the  design,  development  ar.d  m^nufo :tu:  ing  of 
future  equipment. 

4.  CONCLUSIONS 

An  information  system  providing  a general  as  w«H  as  analytic  knowledge  of 
the  reliability  of  equipment  in  service  is  an  indispensable  tool  for  promoting 
^quality.  It  enables  one  to  introduce  guaranteed  -eliability  clauses,  a decisive 
clement  in  arousing  the  supplier’s  interest,  and  an  efficient  means  of  optimizing 
the  "cost-reliability"  criterion.  Fundamentally,  such  an  information  system  makes- 
jit  possible  to  close  the  loop  of  the  reliability  development  programme  by  giving 
the  origin  «nd  nature  of  failures  observed  lr  actual  operation. 

The  causes  of  poor  reliability  in  avionic  equipment  can  be  found  at  the  design, 
manufacturing  and  utilization  stages,  i-'.cre  precise-ly,  these  causes  are  essentially 
the  following  : 

1 

l - at  the  design  stage  : core.-rn  for  performance  to  the  prejudice  of 

reliability  ; pursuit  of  novelty  rather  than  safety  ; haste  and  lark 
of  experience. 

- at  the  manufacturing  stage  : disregard  for  reliability  in  order  to 
reduce  costs  ; insufficient  reliability  programmes  ; various  human 
factor-c . 


/ 


/ 
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- at  the  utilization  level  : care  for  the  initial  cost  rather  than  for 
the  total  cost  ; faulty  definition  of  the  conditions  of  usr  and  Disap- 
preciation of  the  environment  ; inadequate  action. 


The  author  acknowledges  with  thanks  the  assistance  of  Kr.  A.  Laurtrison  in  drawing 
up  this  text. 
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IMPACT  OF  RELIABILITY  IMPROVEMENT  WARRANTY  (RIW) 
ON  AVIONIC  RELIABILITY 

by 

C.  A.  Hardy 

Group  Engineer,  Research  and  Engineering  Department 
General  Dynamics  Corporation,  Fort  Worth  Division 
Fort  Worth,  Texas  76101,  U.S.A. 


SUMMARY 

The  Air  Force  has  provided  incentives  to  contractors  of  new  systems  to  design  and 
produce  electronic  equipment  with  low  failure  rates  and  low  repair  costs  in  operational 
use.  These  incentives  are  included  in  procurement  contracts  as  Reliability  Improvement 
Warranty  (RIW)  provisions.  The  RIW  provisions  obligate  the  contractor  to  accomplish 
repair  and  replacement  of  failed  equipment  at  a fixed  price  during  operational  use  of 
the  equipment  by  the  Air  Force.  The  contractor  also  guarantees  the  mean-time -be tween - 
failure  of  the  equipment  during  the  warranty  period.  RIW  is  projected  to  have  a signi- 
ficant impact  on  avionic  reliability. 


INTRODUCTION 

Reliability  Improvement  Warranty  (RIW)  contracting  is  being  billed  as  a new 
concept  in  airplane  hardware  procurement  that  will  lead  to  improved  reliability  and  re- 
duced support  cost,  thus  putting  teeth  in  the  Department  of  Defense's  life-cycle-cost 
ccmnitments  in  acquisition  contracts.  This  paper  describes 

o What  Reliability  Improvement  Warranty  (RIW)  is 

o Why  the  services  are  promoting  RIW 

o Where  RIW  got  its  start 

o To  what  equipment  RIW  is  applied 

o What  an  RIW  contract  contains 

o A contractor's  response  to  RIW  during  proposal  development  and  production 
phases 

o Air  Force  areas  of  study  toward  making  RIW  a viable  concept. 


RELIABILITY  IMPROVEMENT  WARRANTY  (RIW)  DEFINED 

An  RIW  contract  l the  U.  S.  Air  Force  and  a contractor  obligates  the  con- 

tractor to  accomplish  repair  ai.-  -"placement  of  failed  aeronautical  equipment  at  a fixed 
price  duri-  operational  use  of  the  equipment  by  the  Air  Force.  Under  RIW,  failed 
equipment  is  returned  to  the  contractor,  and  the  repair  and  replacement  are  accomplished 
at  no  expense  to  the  Air  Force  Tor  specified  duration  of  fl ight /operate  time  or  calendar 
time.  The  manner  in  which  a typical  RIW  contract  functions  is  depicted  in  Figure  1. 

Inherent  l.'  the  f i^ed-price  contract,  the  Air  Force  provides  an  incen..-  iur  the 
contractor  to  Improve  the  reliability  and  maintainability  of  the  equipment.  If  during 
the  course  of  the  warranty  period  the  contractor  determines  that  an  equipment  change 
would  reduce  the  number  of  future  repair  actions,  and  that  this  change  coupled  with  the 
less  frequent  occurrence  of  repairs  in  the  future  will  result  in  less  contractor  monev 
being  spent  during  the  remaining  warranty  period,  he  can  submit  this  change  in  a no- 
cost-to-LSAF  equipment  improvement  engineering  change  proposal  (ECP). 

Another  provision  which  can  be  imposed  under  the  RIW  contract  is  the  RIW/MTEF 
guarantee  provision.  Under  this  provision  the  contractor  guarantees  the  equipment  Mean- 
Time-Between-Failure  (MTBF)  experienced  during  Air  Force  operational  usage.  During 
designated  time  periods,  the  MTBF  of  the  equipment  is  assessed.  If  the  assessed  M1BF  is 
less  than  the  guaranteed  MTBF  during  e time  period,  the  contractor  is  required  r r insti- 
tute corrective  action  at  his  expense  until  the  MTBF  improves.  (Reference  1) 


AIRCRAFT  LANOS  WITH 
FLIGHT  CREW  SQUAWKS 


Units  mu  lest  Bjd 
Go  to  Contrictor 


Discrepant 
Warranted 
Unit  Goes  to  ; 
tntermediete 

Shop 


Spare  Replacement  for  Failed 
Unit  to  Flight  Lint 


UNIT  RECEIVES  AF 
GO-NO-GO  TEST 

r rVrrVrVVrV 


Units  that 
; Test  Good 
Go  to  Supply 


Air  Forte  Request  tor 
Replacement  unit 


Unit  Shipped  to  Air  Forte  Within 
One  Day  at  Notification 


•Repair  and  Replacement  is  Performed  at  Contractor  Expense  Unless  Failure  is  Due 
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Figure  1 TYPICAL  WARRANTY  PIPELINE 


THE  NEED  FOR  RIW 

With  Air  Force  Operations  and  Maintenance  (O&M)  costs  rising  rapidly  at  a time  when 
the  defense  budget  is  being  constrained,  it  is  imperative  that  the  Air  Force  find  methods 
of  cost  reduction.  In  the  fiscal  year  1964,  Air  Force  O&M  costs  accounted  for  217.  of  the 
Air  Force  budget,  while  in  fiscal  year  1973,  these  costs  accounted  for  271.  The  O&M 
costs  are  projected  to  continue  to  grow  and  will  take  an  increasingly  larger  percentage 
of  total  Air  Force  dollars.  As  more  dollars  go  to  O&H  costs,  less  dollars  are  available 
for  weapon  system  research,  development,  and  procurement.  To  slow  the  trend  of  increas- 
ing O&M  costs,  contractors  must  place  greater  emphasis  on  cost-effective  methods  of 
accomplishing  support  activities  and  on  increasing  the  field  reliability  of  equipment. 

The  concept  of  RIW  was  presented  to  the  assistant  secretaries  of  the  Military 
Departments  (Research  and  Development  and  Installation  and  Logistics)  in  August  1974  in 
a memorandum  entitled  "Trial  I'se  of  Reliability  Improvement  Warranties  in  the  Acquisition 
Process  of  Electronic  Systems/Equipments  -ACTION  MEMORANDUM".  The  memorandum  was  released 
b>  Arthur  I.  Mendolle,  Ar. distant  Secretary  of  Defense  (I&L),  and  Malcolm  R.  Currie, 
Director,  Defense  Resea. ch  and  Engineering.  The  memorandum  stated  that  as  part  of  the 
Department  of  Defense's  efforts  to  reduce  costs  and  improve  operational  reliability,  trial 
application  of  RIW  should  be  utilized  in  the  acquisition  process  to  help  determine  the 
scope  and  benefits  that  RIW  might  have  for  the  Department  of  Defense. 

The  objective  of  the  RIW  as  set  out  by  the  Department  of  Defense  is  to  motivate 
and  provide  an  incentive  to  contractors  to  design  and  produce  equipment  that  will  have 
low  failure  rates  as  well  as  low  repair  costs  after  failure  due  to  field/operational  use. 

For  some  time,  the  Air  Force  has  been  trying  to  get  improved  reliability  and  main- 
tainability through  procurement  methods  that  include  reliability/maintainability  programs. 
These  have  worked  to  some  extent,  but,  despite  the  use  of  these  methods,  the  Air  Force  is 
still  plagued  with  poor  equipment  reliability  and  high  support  costs.  Under  these  methods 
of  procurement  the  contractor's  responsibility  for  all  practical  purposes  ends  with  the 
delivery  of  the  equipment  to  the  Air  Force.  These  methods  also  put  much  importance  on  low 
procurement  price,  thus  causing  contractors  to  design  and  develop  equipment  with  the 
lowest  reliability  that  will  pass  contract  requirements. 

RIW  represents  a new  trial  concept  in  Department  of  Defense  contracting  with  the 
primary  objective  of  extending  the  contractor's  responsibility  to  include  operational 


6-3 


* 


reliability  of  equipment  during  Air  Force  usage.  Past  experience  indicates  that  there  is 
reliability  growth  from  time  of  the  initial  design  to  the  maturity  of  equipment  in  opera- 
tional usage.  With  the  application  of  RIW,  the  contractor  is  directly  involved  during 
this  period  and  should  be  able  to  accelerate  reliability  improvements  and  minimize  the 
cost  associated  with  incorporating  these  improvements. 

Imposing  RIW  can  serve  as  a most  effective  method  of  closing  the  Information  gap 
between  the  Air  Force  usage  of  equipment  and  the  contractor  who  controls  equipment  design. 
With  RIW,  the  contractor  is  motivated  to  find  out  a lot  more  about  what  his  equipment  is 
doing  in  the  field  and  to  initiate  changes  to  decrease  future  failures  and  thus,  to  decrease 
his  cost  cf  meeting  RIW  responsibilities.  Under  RIW,  the  contractor  becomes  actively 
interested  in  asset  management  and  the  control  of  problems  which  are  usually  thought  of 
as  Air  Force  responsibilities.  Turnaround  of  equipment,  which  is  always  vital  to  the  Air 
Force,  is  now  vital  to  the  contractor  also.  Under  RIW,  with  contractor  direct  involve- 
ment, the  lead  time  associated  with  reliability  and  maintainability  improvements  should 
be  greatly  shortened  since  further  capital  investment  is  not  required  from  the  Air  Force 
and  the  contractor  will  push  the  improvement  change  to  decrease  his  future  repair  costs. 

Department  of  Defense  guidelines  for  the  trial  use  of  RIW  during  procurement  spell 
out  the  following  potential  benefits  to  the  Government  and  to  the  contractor: 

"Benefits  to  Government 

a.  Incentives  and  responsibility  for  field  reliability  are  assigned  to 
the  contractor. 

b.  Greater  emphasis  is  placed  on  the  life-cycle-cost  approach. 

c.  The  contractor  is  responsible  to  keep  all  units  up  to  the  same 
configuration. 

d.  There  is  an  increased  incentive  for  the  contractor  to  introduce 
design/producticn  changes  that  will  increase  the  MTBF  of  the  equipment  and 
result  in  reliability  growth. 

e.  An  Incentive  for  reduction  in  repair  costs  is  provided,  since  any 
reduction  in  labor  hours  or  materials  used  in  repairing  equipment  will 
increase  the  contractor's  profits. 

f.  Minimal  initial  support  investment  is  required  by  the  Government, 
since  the  contractor  is  to  provide  repair  services  during  the  warranty  period. 

g.  RIW  usage  may  reduce  re*',  airements  for  skilled  military  maintenance 
and  support  manpower. 

Benefits  to  Contractor 

a.  Increased  profit  potential  when  field  MTBF  is  improved  above  pricing 

base. 

b.  Multi-year  guaranteed  business. 

c.  The  contractor  becomes  more  familiar  with  the  operational  reliability 
and  maintainability  characteristics  of  his  equipment  which  should  help  him  in 
obtaining  follow-on  contracts." 

Thus,  under  RIW  procurement,  the  objective  of  both  the  Air  Force  and  the  contractor  is  thr 
same  - to  reduce  the  rate  of  equipment  removal  and  repair.  If  successful,  the  Air  Force 
will  have  a more  effective  weapon  system  and  the  contractor  will  have  reduced  the  cost  of 
meeting  his  RIW  obligations.  The  RIW  concept  provides  a means  for  continuous  product 
improvement  by  having  "reliability"  be  of  equal  importance  with  "functional  performance." 
(References  1,  ?) 

THE  START  Oi  RIW 

The  forerunner  of  the  RIW  concept  was  the  U.  S.  Navy  Failure  Free  Warranty  (FFWt 
program  with  Lear  Siegler  on  a two-gvro  platform  in  1967. 

Lear  Siegler  designed  the  two-gyro  platform  for  the  Navy,  and  production  quanti- 
ties were  delivered  in  the  late  1950s.  In  the  early  1960s,  Lear  Siegler  and  the  Navy 
were  both  overhauling  the  gyroscopes.  In  1967  Lear  Siegler  proposed  the  failure-free 

warranty  concept  to  the  U.  S.  Navy  and  was  put  under  contract.  The  proposal 
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centered  around  a fixed  price  to  cover  overhaul*  required  during  a long-term  field 
operating  period.  The  contract  Included  the  following: 

o The  overhaul  of  inservice  gyro*  - 800  gyroa  guaranteed  for  1500  hour*  or  5 year* 
whichever  occur*  first. 

o A fixed  price  based  on  337.  of  reliability  Improvement  over  the  contract  period, 
o A specified  turnaround  time. 

Resu^s  of  the  FFW  contract  were  that  the  gyro'*  reliability  had  exceeded  expectations 
and  the  Navy  saved  approximately  $2  million. 

Since  the  FFW  contract  with  l^ar  Slegler,  the  services  have  initiated  RIW  contracts 
on  such  Items  as  the  ARN-XXX  TACAN  and  the  major  avionics  on  the  F-16.  Application  of  the 
RIW  on  the  F-16  will  be  discussed  lat« l in  this  paper.  (References  2,  3,  4,  5) 


EQUIPMENT  TO  WHICH  RIW  IS  APPLIED 

Not  all  equipment  types  are  likely  candidates  for  RIW  coverage.  For  example, 
equipment  whose  construction  precludes  the  installation  of  seals  or  other  control  mechan- 
isms to  prevent  unauthorized  field  repair  may  not  be  good  candidates.  Direction  from  the 
Department  of  Defense  as  to  what  equipment  types  should  be  considered  is  Included  in  the 
RIW  guidelines,  which  were  an  attachment  to  the  memorandum  entitled  "Trial  use  of  Relia- 
bility Improvement  Warranties  in  the  Acquisition  Process  of  Electronic  Systems/Equipment." 
Selected  equipment-related  criteria  for  likely  equipment  types  to  be  covered  by  RIW 
contained  in  the  guidelines  are  presented  below: 

o The  equipment  is  readily  transportable  to  permit  return  to  the  vendor's  plant 
or,  alternatively,  the  equipment  is  one  for  which  a contractor  can  provide  for 
field  service. 

o The  equipment  is  generally  self-contained,  is  generally  inmune  from  failures 
induced  by  outside  units,  and  has  readily  identifiable  failure  characteristics, 

o Moderate  to  high  initial  support  costs  are  involved. 

o Equipment  application  in  terms  of  expected  operating  time  and  the  use 
environment  are  known. 

o The  equipment  is  susceptible  to  being  contracted  for  on  a fixed-price  basis, 

o The  equipment  has  a potential  for  both  reliability  growth  and  reduction  in 
repair  costs. 

o A sufficient  quantity  of  the  equipment  is  to  be  procured  to  make  the  RIW 
cost  effective. 

o The  equipment  s of  a configuration  that  discourages  unauthorized  field  repair, 
preferably  sealed  and  capable  of  containing  an  Elapsed  Time  Indicator  (ETI)  or 
some  other  means  of  usage  control, 

o A reasonable  degree  of  assurance  exists  that  there  will  be  a high  utilization 
of  the  equipment. 

o The  equipment  is  one  that  permits  the  contractor  to  initiate  no-cost  ECPs 
subsequent  to  the  Government's  approval. 


EQUIPMENTS  INCLUDED  IN  PRESENT  RIW  CONTRACTS 

The  F-16  aircraft  contract  serves  as  a good  recent  example  of  the  application 
of  the  RIW  concept.  A summary  description  of  the  F-16  aircraft  and  a list 
of  that  equipment  involved  in  the  RIW  provisions  of  the  contract  are  given  in 

Figure  2,  All  the  equipment  listed  is  electronic  equipment,  and  its  selection  for  inclu- 
sion under  RIW  meets  the  general  Department  of  Defense  selection  criteria.  Another 
criterion  used  in  the  selection  of  the  F-16  equipment  to  be  Included  under  RIW  was  the 
equipment's  projected  logistic  support  cost  during  Air  Force  usage.  A brief  presentation 
of  the  use  of  the  cost  criterion  in  the  selection  of  F-16  RIW  candidate*  is  given  in 
Figure  3.  Detailed  discussions  of  logistic  support  cost  analyses  on  the  F-16  are  given 
in  a later  paper  in  thla  volume. 
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Figure  2 SELECTED  F-16  EQEIPMENT  ARE  INVOLVED  IN  RIW 


THE  CONTENT  OF  AN  RIW  CONTRACT 

Because  specific  RIW  provisions  should  be  tailored  to  the  weapon  svstem  or  equip- 
ment being  warranted,  a standard  set  of  specific  terms  and  conditions  do  not  esist. 
However,  the  warranty  section  of  the  F-16  contract  can  be  reviewed.  This  review  consti- 
tutes a ftiinnary  of  the  salient  terms  and  conditions  of  the  F-16  contract  and  will  serve 
to  outline  the  basic  Ingredients  contained  In  present-day  RIW  contracting. 


f-16  Ri'UAMi.m  improvement  warranty 


The  contractor  agrees  to  provide 
(*t  firm  fixed  price*  included  in  the 
contract)  either  of  two  options: 


o A 48-month  (or  300,000-f  1 ight 
hour)  re  It  Ability  improvement 
warranty  on  Any  or  Ail  of  the 
First  Line  Units  (Fl.Us)  listed 
in  TAble  1.  (This  option  wl * 1 
b*  referred  to  as  the  RIW  op  ton.) 

o A 48 -month  (or  J00 ,000-f 1 ight 
hour)  reliability  improvement 
warranty  with  an  MTBF  guarantee 
on  any  or  All  of  the  Fl.Us  listed 
in  Table  l.  (This  option  will 
be  referred  to  as  the  RtU/MTBF 
option.) 


AIR  FORCE  EXERCISE  OF  OPTIONS 

Any  of  the  options  can  be  exercised  on  or  before  production  go-ahead.  The  warranty 
period  starts  at  delivery  of  the  first  production  airplane  and  continues  fcr  48  months  of 
300,000  flight  hours,  whichever  comes  first.  In  addition,  the  contractor  agrees  to  nego- 
tiate extending  the  warranty  period  for  additional  24-month  periods  at  the  option  of  the 
government . 


TABLE  1.  FLU  LIST 


FLU 

FY  -Dollar* 

RIW 

R 1 W / */]  K* 

Flight  Control  Computer 
Heads-Up  Display 
Heads-Up  Dl  splay  Electronics 
Fire  Control  Computer 
Inertial  Navigation  Unit 
Radar  E/0  Display 
Radar  E/O  Electronic 
Radar  Antenna 
Radar  Transmitter 
Radar  Digital  Processor 
Radar  Computer 
Radar  Low  Power  RF 

WARRANTY  AN0  REPAIR  STATEMENTS 

The  contractor  warrants  that  each  FLU  delivered  under  the  production  contract  or 
associated  separate  spares  contract  will  be  free  from  defects  in  design,  material,  and 
workmanship  and  will  operate,  when  required,  in  its  intended  environment  in  accordance 
with  contractual  specifications,  for  the  warranty  period  set  forth.  Any  FLU  that  fails 
to  meet  the  warranty  will  be  returned  to  the  contractor  (at  Government  expense)  and  will 
be  repaired  or  replaced  (at  contractor  expense). 

The  contractor  shall  not  be  obligated  to  repair  or  replace  at  no  cost  to  the 
Government  any  warranted  FLU  that  is  lost  or  damaged  by  reason  of  fire  explosion,  sub- 
mersion, flood,  aircraft  crash,  enemy  combat  action,  or  tampering  by  Government  personnel, 
provided  there  is  clear  and  convincing  evidence  of  such  cause.  In  addition,  the  contrac- 
tor shall  not  be  obligated  for  repair  of  physical  damage  caused  by  mistreatment  or  tamper- 
ing by  non-contractor  personnel.  The  contractor  is  not  liable  for  special  consequential 
or  incidental  damages. 

Any  failed  FLU  not  covered  by  warranty  that  is  returned  to  the  contractor  will  be 
repaired  as  directed  by  the  Government  for  an  equitable  price/cost  adjustment. 


CONTRACTOR  OBLIGATIONS 

tn  addition  to  the  basic  warranty  and  repair  statements  mentioned  above  there  is  a 
list  of  comprehensive  contractor  obligations  Included  In  the  contract.  These  obligations 
are  summarized  below. 

o All  contractor-initiated  F.CPs  for  improved  reliability  and  malntainabt  1 itv 
approved  by  the  Government  will  be  incorporated  at  no  cost  to  the  Government. 

As  each  FLU  is  repaired  bv  the  contractor,  it  will  be  brought  up  to  the  latest 
configuration.  Kits  will  be  provided  for  unr*  .ifled  Fl.Us  at  the  end  of  the 
warranty . 

o A suitable  and  prominent  display  of  warranty  information  will  be  placed  on  the 
surface  of  each  FIX'. 

o At  least  one  fully  operational  warrant v-repa I r facilitv  will  be  maintained  at 
a location  to  minimize  pipeline  time.  The  facilitv  will  include  a secure 
storage  area  for  spares 

o Seal*  will  be  insta  l led  on  a 1 1 warranted  Fl.l'a  to  minimi  ze  unauthorized  maintenance. 


o When  a FU'  falls,  the  Government  not  1 fir s the  contractor  in  writing  or  by 

electronic  message,  Shipment  of  a replacement  spare  will  be  within  one  working 
dav,  but  not  later  than  7/  hour*  after  notification. 

o The  repair,  replacement,  and/or  Inrorporat Ion  of  approved  reliability  and 

ma  int  al  nahi  1 1 1 v modi  rlcat  Ion*  on  all  returned  Fl.lis  rmiat  be  completed  and  FIX' a 
stored  In  secure  storage  on  a turnaround  time  average  of  a specified  unber 
of  day*. 

o Actual  average  turnaround  time  will  he  computed  in  6-month  Interval*.  If  the 
actual  value  during  a 6-month  period  i*  greater  than  the  specified  average 
turnaround  time  for  returned  Ill’s,  a penalty  will  be  assessed.  The  contractor 
will  lend  the  Government  consignment  Ill's  if  spare  shortages  occur.  The  maxi- 
mum number  of  consignment  spares  that  are  to  he  provided  are  determined  by  an 
equation  In  the  contract.  If  consignment  Ill's  are  not  provided,  a dollar 
penalty  Is  Incurred  In  accordance  with  the  contract. 

o The  contractor  will  Include  applicable  warranty  Information  In  all  pertinent 
technical  manuals. 


GOVl RNMF.NT  OBLIGATIONS 

There  are  also  Government  obligations  written  Into  the  contract.  These  obligation* 
are  summarised  as  follows: 

o Failures  will  be  verified  by  the  Government,  using  appropriate  procedures  and 
test  equipment. 

o The  Goverm.  will  provide  the  contractor  with  failure  circumstance  data. 

o MTL-STO-794  pi  kaging  will  be  used  to  the  extent  possible  on  shipment  of  FLUs. 

o Failed  FIX'S  will  be  shipped  promptly  to  the  contractor. 

o The  contractor  will  be  notified  of  a failed  Fl.l’,  and  shipping  Instructions  will 
be  provided  for  delivery  of  a replacement  unit. 

o The  Government  will  provide  the  contractor  information  on  accumulated  flight 
hours  on  F-16  aircraft. 

o No-cost  Reliability  and  Ma 1 ntalnabl l l t y Engineering  Change  Proposals  (ECPs) 
submitted  will  be  Incorporated  Into  the  contract  "X"  days  after  receipt  unless 
the  contractor  receives  written  notification  of  non-approval  by  the  Government 
prior  to  that  date. 


WARRANTY  DATA  REQUIREMENTS 

The  contractor  will  develop  and  maintain  a data  accumulation,  processing,  analysis, 
and  repo*-  lng  system  capable  of  providing  the  data  items  necessary  for  implementing  any 
of  the  provisions  of  the  warranty  and  capable  of  providing  to  the  Government  data  and 
Information  on  the  reliability  of  a warranted  FIX',  The  internal  contractor  data  system 
should  provide  data  such  as  shown  In  Table  2, 


RIW/MTBF  Gl' A RANT  EE  OPTION 

If  the  Government  decides  to  exercise  the  RIW/MTBF  guarantee  option,  the  following 
provisions  apply  In  addition  to  those  of  the  basic  R1W  option  stated  in  prior  paragraphs: 

o Hie  contractor  guarantees  that  each  FU’  delivered  under  the  production  contract 
or  associated  spares  contract  will  achieve  an  7TTBF  equal  to  or  greater  than 
that  shown  In  Table  1, 

o For  this  guarantee,  MTRF  Is  defined  to  be  total  operating  hours  accumulated  on 
all  units  during  a specified  period  divided  by  the  total  number  of  fall  jres  of 
all  such  units  during  that  period. 

o For  purposes  of  the  TTRF  measurement,  failures  will  Include  all  replacement  or 
repair  actions  performed  under  the  R IW  provision  except  thos  repair  and  replace- 
ments covered  under  the  exclusion  clause  and  except  anv  FI.l’  which  la  returned 
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TABLE  2.  RIW  CONTRACTOR  DATA  ELEMENTS 


RIU  AND  RIU/MTBF  DATA 


O CONFIGURATION  CONTROL  DATA 

o Configuration  Control  by  Serial  Number 

o All  Change*  to  Configuration,  Design,  Part,  T.O.,  or  AGE  that 
Affect  Form,  Fit,  or  Function 
o Changes  that  Do  No  Affect  Form,  Fit,  or  Function 

o FLU  INITIAL  DELIVERY  DATA 

o THE  FOLLOWING  FOR  EACH  RETURNED  FLU 
o Date  Received  by  Contractor 
o Serial  Number 
o ETt  Reading 

o Condition  of  Unit  Based  on  Initial  Inspection 
o Failure  Mode 
o Probable  Failure  Cause 
o Action  Taken  for  Repair 
o Manhours  Expended  by  Labor  Category 
o Parts  and  Material  Usage 
o Test  Results 

o Date  Stored  in  Secure  Storage  Area 
o Hour  and  Date  of  Notification  of  a Failure 

o Hour  and  Date  Replacement  Unit  Is  Shipped  from  Secure  Storage 


and  tests  out  well  at  the  repair  facility. 

o For  purposes  of  MTBF  measurement,  total  operating  hours  will  be  computed  by  use 
of  equations  In  the  contract.  These  equations  are  based  on  elapsed  operating 
time  from  failed  units. 

o For  each  type  of  FLU,  the  contractor  will  make  semi-annual  measurements  of  the 
FLU  MTBF  achieved  over  the  previous  6 months.  The  first  measurement  will  be 
made  A months  after  the  initial  anniversary  date.  The  contractor's  obligation 
termii  ites  when  two  consecutive  measurements  yield  FLU  MTBF  values  that  equal 
or  exi  the  guaranteed  MTBF  values  for  Period  3,  but  In  no  event  will  the 
obllga  < • • -rminate  earlier  than  18  months  after  Initial  anniversary  date. 

o In  the  eve..  measured  MTBF  for  any  measurement  period  is  less  than  the 

guaranteed  value,  contractor  will  furnish  to  the  Government  the  following: 

a.  Englneerii  g analyses  * ">  determine  causes  of  non-conforming  MTBF. 

b.  Correctivt  engineering  design  changes. 

c.  Modification  of  the  FLUs,  spare  FLUs,  and/or  spare  parts,  as  required,  at 
contractor  expense. 

d.  Pipeline  unit  spares  as  needed  by  the  Government  on  a consignment  (no-charge 
loan)  basis  but  no  greater  than  a quantity  computed  by  an  equation  in  the 
contract. 


TABLE  3.  MTBF  GUARANTEE  VALUES 


FLU  MTBF*  S 

FLU 

PERIOD  1 

PERIOD  2 

PERIOD  3 

1 THRU  12  MONTHS 

13  THRU  24  MONTHS 

25  THRU  36  MONTHS 

NAVIGATION  UNIT 
FLIGHT  CONTROL  COMPUTER 
RADAR/E -0  DISPLAY 
HF.AD-UP  DISP1AY 
HUD  ELECTRONICS 
RADAR/F.-O  ELECTRONICS 
RADAR  FLUs 

* For  calendar  time  from  initial  anniversary  date 
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CONTRACTOR'S  RESPONSE  TO  RIW  DURINC  PROPOSALS 


On*  of  Ch*  bluett  realization!  for  th*  weapon  system  contractor  when  he  receives 
a Request  for  Proposal  (RFP)  that  contains  an  RIW  requirement  Is  that  the  customer  Is 
asking  him  to  delve  Into  an  area  that  historically  he  has  not  been  directly  Involve!  In. 
That  is,  hts  responsibility  Is  being  extended  to  Include  operational  or  field  perf  rsance 
with  the  major  objective  of  demonstrating  higher  operational  reliability  and  reduc  sup- 
port costs.  In  developing  his  proposal,  the  contractor  looks  to  prior  contracts  anc  tees 
little  precedence  and  historical  Information  on  this  type  of  contract.  Not  withstand!  <g, 
Industry  Is  fully  aware  of  the  dilemma  the  services  are  In  - they  are  troubled  with  equip- 
ment having  low  reliability  and  high  support  cost  and,  at  the  same  time,  they  are  trying 
to  reduce  these  problems  with  a new  concept.  Industry  realizes  that  the  services  are 
taking  a new  approach  toward  In, proving  the  total  support  postute  of  a weapon  system.  This 
new  approach  Is  RIW,  which,  as  a main  Ingredient,  Includes  the  Involvement  of  the  cor' -ac- 
tor and  Government  as  a team,  both  with  the  identical  aim  - to  reduce  the  rate  of  equipment 
removal  and  repair. 

One  of  the  most  Important  elements  In  the  building  of  the  RIW  response  Is  that  f 
properly  pricing  the  warranty.  All  activities  projected  to  be  accomplished  and  all  t!  j 
major  factois  that  Influence  these  activities  must  be  identified,  analysed,  and  conve:  ed 
Into  costs  -costs  that  are  projected  far  enough  Into  the  future  to  cover  the  time  basi  of 
the  contract.  Items  typical  of  those  to  be  included  are: 

o Projected  unit  returns  - fal led  units,  good  units 

o Repair  tlme/falled  unit 

c Test  time /good  unit 

o Repair  and  test  hour  costs 

o Material  costs 

o Asset  control 

o Test  and  repair  equipment  and  facilities 
o Data  collection 
o Engineering  analysts 
o Failure-rate  improvement  trend 
o Modification  costs 
o Reporting  to  customer 
o Direct  labor  rates 
o Overhead  costs 
o Profit 

The  determinat ic  .1  of  the  projected  return  rate  and  of  the  proposed  guaranteed  MTBF 
of  warranted  equipment  are  two  of  the  most  difficult  parameters  to  quantify.  In  the  F-16 
contract,  the  avionics  that  were  under  consideration  for  the  airplane  were  generally 
derivatives  of  avionics  already  in  operational  use  or  derivatives  of  avionics  that  had 
undergone  some  type  of  prototype  testing.  Since  the  return  rate  and  operational  MTBF  were 
to  be  a function  of  the  equipment  In  Air  Force  use,  being  handled  and  tested  by  Air  Force 
personnel  and  controlled  bv  Air  Force  data  systems  and  asset  control,  the  projected  rates 
of  return  and  MTBF  were  determined  by  use  of  Air  Force  data  (e.g.,  AFM  66-1  datal.  The 
failure  rates  of  same  family  and/or  similar  equipment  were  modified  as  a function  of  pro- 
jected simplification,  design  changes,  state-of  the  art  improvements,  environmental 
differences,  etc.,  to  derive  estimates  of  the  projected  return  rates  and  operational  MTBFs 
for  the  F-16  program. 


CONTRACTOR'S  RESPONSE  TO  RIW  Dl'RING  DEVEI.OPMENT 


Contracts  such  as  the  F-16  contain  the  RIW  provisions  as  options  to  be  exercised 
during  the  development  phase  prior  to  production  go-ahead  or  spare*  provisioning.  The 
contractor's  response  during  the  ievelopment  phase  will  be  prompted  by  the  timeliness  and 


sincerity  of  Air  'orce  decisions  end  actions  on  RIW. 

Prior  to  the  Air  Force  exercii  *.ng  the  RIW,  the  development  contracts  will  by  neces- 
sity be  executed  on  the  basis  of  trad  tlonal  and  conventional  contract  provisions.  New 
weapon  system  contracts  have  a rlgoro.  s,  formal  reliability  and  maintainability  program, 
which  Includes  requirements  for  R&M  design  reviews,  parts  selection  and  screening,  pre- 
dictions. failure  modes  and  effects  analyses,  and  formal  reliability  testing  of  contractor- 
furnished  avionics  In  the  laboratory  under  environment  during  development  and  production 
phases.  Under  this  traditional  contracting  method,  if  the  RIW  provisions  are  not  involved, 
for  all  practical  purposes  the  contractor's  liability  extends  to  delivery  and  acceptance 
of  equipment. 

On  the  basis  of  some  studies  that  have  been  completed.  It  appears  that  to  accomplish 
the  objective  of  RIW,  which  is  to  improve  reliability  and  reduce  support  costs,  It  would 
be  most  advantageous  to  exercise  the  RIW  as  early  as  possible  during  the  development  phase. 
These  studies  indicate  that  over  907.  of  the  decisions  that  determine  life  cycle  cost  are 
made  by  the  end  of  Full  Scale  Development.  When  the  RIW  options  on  a contract  such  as 
the  F-16  are  exercised,  these  options  will  be  exercised  before  production  go-ahead.  This 
means  that  part  of  the  design  and  development  phase  is  still  being  accomplished.  Once 
the  RIW  options  are  exercised  on  a contract,  the  contractor  has  a definite  incentivf  to 
change  his  business-as-usual  design  methods  to  methods  that  investigate,  identify,  and 
reduce  the  number  of  potential  removals  and  repair  through  design  innovations. 

Instead  of  trying  to  design  the  lowest-cost  equipment  that  will  meet  engineering 
and  reliability  qualification,  the  contractor's  objective  will  change  to  that  of  designing 
to  the  lowest  cost  per  operate  hour,  which  allows  him  to  use  more  expensive  materials  and 
components  in  areas  that  will  improve  MTBF.  If  the  contractor  determines  that  a more 
rigorous  and  costly  quality  control  effort  on  particular  components  would  offer  a signifi- 
cant improvement  in  MTBF  and  at  the  same  time  be  cost-effective  in  terms  of  maximum  number 
of  equipment  operate  hours  per  dollar,  he  could  and  would  institute  such  an  effort. 

Even  the  performance  of  all  reliability  program  tasks  would  be  influenced.  For 
example,  during  the  conventional  contract  reliability  test,  the  contractor  is  vitally 
interested  in  the  relevant  failures  that  occur  during  the  test.  With  RIW,  emphasis  is  put 
on  all  failures  that  significantly  influence  return  rates  and  guaranteed  MTBF,  and  correc- 
tive action  would  be  taken  to  preclude  their  occurrence  in  the  field. 

Under  conventional  contracting,  engineering  efforts  associated  with  support  problems 
are  not  well  organized.  With  RIW,  as  a function  of  management  necessity,  engineering  and 
design  is  thrust  more  directly  and  with  full  involvement  into  the  arena  of  problem  solving 
to  improve  the  support  aspects  of  the  contractor's  product. 

During  development  flight  testing,  as  the  weapon  system  is  being  flown  by  both 
contractor  and  Air  Force  personnel,  the  contractor  has  his  first  opportunity  to  establish 
a tracking  system  on  RIW  units  in  an  environment  similar  to  Air  Force  operations.  During 
this  period,  reliability  and  design  engineers,  coupled  with  quality  control  and  logistic 
personnel,  track  the  performance  and  problems  of  RIW  units  and  evaluate  asset  and  inventory 
control  processes.  Actual  performance  of  RIW  items  during  flight  test  are  compared  with 
those  projected  during  contract  negotiations  to  find  problem  areas  and  initiate  corrective 
action  as  required.  (Reference  2) 


CONTRACTOR’S  RESPONSE  TO  RIW  DURING  PRODUCTION 

With  the  Air  Force  commitment  to  production  go-ahead  with  RIW,  the  contractor  is 
signaled  to  begin  putting  into  effect  the  RIW  provisions  of  the  production  contract.  On 
contracts  like  the  F-16,  the  contractor  puts  into  effect  the  individual  equipment  subcon- 
tractor's RIW  provisions. 

Within  a period  of  several  months  from  contract  go-ahead,  the  contractor  submits  a 
plan  to  the  Air  Force  detailing  the  contents  of  two  reports  to  be  submitted  to  the  Air 
Force  • one  covering  RIW,  the  other  covering  RIW/MTBF: 

o Under  RIW,  the  Warranty  Data  Report  is  provided  semi-annually.  This  report 
covers  the  warranty  experience  over  a 6-month  reporting  period. 

o Under  RIW/MTBF,  the  MTBF  Data  Report  is  provided  at  the  end  of  each  measure- 
ment period.  This  report  covers  the  information  pertinent  to  the  MTBF 
guarantee  clause. 


The  contractor  Installs  two  Items  on  each  warranted  unit  prior  to  delivery:  a seal 
to  prevent  unauthorized  maintenance  and  a placard  with  the  Information  that  the  unit  is 
under  warranty. 

Test,  repair,  and  modification  facilities  are  activated  to  Implement  action  on  all 
returned  units.  Under  RIW,  certain  activities  are  added  to  those  performed  under  conven- 
tional overhaul  contracts.  Examples  of  some  of  these  activities  are  as  follows: 

o Engineering  Is  involved  In  tear  down,  part  replacement,  and  assembly.  Engineer- 
ing performs  Inspection  and  analysis  of  faulty  parts  to  determine  failure  modes 
and  of  selected  other  parts  to  determine  probable  future  failure  modes. 

o Rigorous  technical  analyses  are  performed  with  fleet  data  on  failed  units  and 
with  ln-house  data  from  repair,  overhaul,  and  test  to  determine  changes  that 
would  decrease  the  return  rate  of  units  -changes  In  design,  parts,  quality 
control  procedures,  or  overhaul  procedures. 

As  design  improvements  are  indicated  as  s result  of  field  performance  feedback  and 
ln-house  evaluations,  the  Improvements  are  made.  Under  conventional  contracting  these 
Improvements  would  he  delayed  or  never  made  because  of  the  long  process  of  paper  work  or 
of  additional  funding  requirements. 

Asset,  configuration,  und  inventory  control  processes  are  Implemented  conroensurate 
with  the  higher  administrative  and  technical  attention  that  is  required  under  RIW  contract- 
ing. These  controls  are  vital  to  the  operation  of  RI'«.  A piece  of  equipment  that  Is 
sitting  In  a receiving  area  or  delayed  in  the  repair  cycle  or  belatedly  modified  to  the 
latest  configuration  is  a detriment  to  the  successful  accomplishment  of  turnaround  time 
within  the  specified  time  In  the  contract  and  within  b-  '6eted  dollars. 

A system  of  quantitatively  tracking  all  parameters  that  critically  Influence  RIW 
Is  implemented.  Technical  and  administrative  management  must  know  the  status  of  RIW,  the 
problem  areas,  and  the  impact  of  proposed  design  or  procedural  changes  on  RIW  performance 
so  that  comparisons  can  be  made  of  actual  performance  versus  required  KTBFs , turnaround 
times,  replacement  response,  etc.  (Reference  2) 


AIR  FORCE- INDUSTRY  STUDY  KEY  ISSUES 

Since  RIW  Is  a new  procurement  process  for  the  services  and  there  Is  little  prece- 
dence or  historical  data  on  this  type  of  contracting,  the  Air  Force  Is  particularly  inter- 
ested in  some  elements  of  the  Implementations  of  RIW.  This  Interest  Is  centered  about  the 
proper  application  of  some  of  the  aspects  of  RIW  so  that  RIW  as  contracted  will  be  viable 
and  will  properly  attain  the  objectives  of  improved  reliability  and  reduced  support  costs. 
Some  of  the  key  Issues  requiring  Air  Force  guidance  that  are  being  studied  by  the  Air 
Force  and  Industry  are  siamnarized  below: 

MTBF  Requirements 

o Should  the  Government  specify  a minimum  MTBF? 

o Should  a joint  Government /Industry  group  review  these  requirements  prior 
to  RFP  release? 

o Should  the  MTBF  be  as  defined  in  MIL-STD-781B  or  should  it  be  an  operational 
value? 

o When  should  the  MTBF  requirement  be  applied  and  should  it  be  related  to 
growth  or  a point  estimate  value? 

Failures 


o Is  a frllure  defined  as  a removal  for  any  cause  or  should  there  be  exclusions? 
What  exclusions  should  be  taken? 

o How  should  turnaround  time  be  defined  and  applied? 

Timing  of  RIW  Application 

o When  and  how  should  RIW  be  applied?  (parallel  development,  competitive 
development,  competitive  production,  options,  tie  to  milestones) 

o How  long  should  the  duration  of  the  warranty  be? 
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RIM  Contracting  Basis 

0 What  type  of  a contract  should  it  be?  (RDT&E  phase  with  designed-in 

reliability,  production  with  reliability  and  maintainability  improvements) 

o What  type  of  an  incentive  structure  should  be  applied? 

o What  should  the  reward-penalty  relationship  be? 


CONCLUSIONS 

Reliability  Improvement  Warranty  contracting  provides  a new  viable  concept  in 
fixed-price  procurement,  which,  when  executed,  extends  the  contractor's  responsibility 
for  the  performance  of  his  equipment  into  the  operational  phase  and  can  result  in  improved 
reliability  and  reduced  supply  cost.  Reliability  Improvement  Warranty  is  now  being 
applied  on  a trial  basis  and  will  require  a new  type  of  Innovative  management  and  techni- 
cal administration  of  cont-acts  — by  the  Air  Force  to  assure  attainment  of  the  objectives 
of  RIW  and  by  the  contractor  to  assure  that  reliability  efforts  do  provide  a reduced  rate 
of  returned  units  and  result  in  the  company  meeting  its  RIW  commitment  at  or  less  than 
the  negotiated  cost. 
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SUWARf 

Commonplace  design  techniques  can  be  applied  to  a development  program  with  the  con- 
straints of  holdirg  a normal  cost  ceiling  and  schedule,  and  these  techniques  can  skillfully 
be  controlled  to  provide  higher  reliability  than  would  otherwise  be  expected.  At  the  other 
extra::..,  special  and  unusual  design  techniques  can  greatly  extend  costs  and  schedule,  but 
with  proper  application  they  can  produce  much  higher  reliability.  This  paper  addresses  the 
general  situation  between  these  two  extremes,  wherein  a difficult  reliability  objective  can 
be  considered  and  techniques  applied  which  will  attain  a preferred  balance  between  relia- 
bility and  all  competing  factors  such  as  performance,  cost,  schedule,  etc. 

for  this  consideration  much  must  be  done  before  development  contract  award,  including 
thorough  understanding  of  the  need  for  the  desired  reliability  and  the  probability  of  its 
attainment  under  various  trades  and  compromises.  Agreement  must  be  reached  on  the  assign- 
ment of  the  first  few  functional  models,  the  availability  of  sophisticated  facilities  for 
failure  analysia,  and  the  provision  of  close  technical  supervision  of  circuit  design  and 
analysis  and  mechanical  layout.  Preferred  sources  for  all  critical  parts  and  materials  must 
be  both  known  and  proven.  It  is  the  author’s  contention  that  adherence  to  the  discussed 
techniques  and  their  Intent  will  generally  lead  to  the  attainment  of  optimum,  reliability 
prior  to  the  need  for  a quantitative  reliability  verification  test,  and  the  question  of 
reliability  growth  during  the  development  program  will  be  academic. 


INTRODUCTION 

Anv  of  several  different  approaches  might  be  selected  and  Identified  as  special  effort 
to  design  for  high  reliability.  The  level  of  effort  will  vary  considerably  among  these 
choices  and  so  probably  will  the  results.  At  the  minimum  effort  extreme  management  can  put 
a celling  on  design  costs  and  encourage  anv  and  all  special  design  effort  so  long  as  it  does 
not  increase  the  cost  or  delay  the  schedule.  With  such  limitations  the  most  productive 
effort  miwht  well  be  to  e-cloy  designers  with  the  greatest  successful  background  of  design 
experience  who  valued  their  reputation  for  sound  design.  Then  ensure  that  they  are  not 
aaslmned  that  which  they  feel  thev  cenrot  accomplish.  Frequently  the  need  for  high  relia- 
bi’ltv  is  recognized  to  be  worth  an  added  increment  of  cost.  Perhaps  the  greatest  benefit 
then  might  be  to  encourage  the  design  team  to  be  more  thorough  and  recheck  its  work  with 
cere,  but  ell  within  the  new  sc-ewh^t  increased  budget  and  schedule. 

This  paper  addresses  the  development  program  wherein  specific  high  quantitative  relia- 
bility is  felt  essential,  and  cost  ceilings  and  schedule  extensions  are  items  for  negotiation 
during  which,  if  necessary,  the  quantitative  level  of  rsqulred  reliability  is  traded  and 
compromised  with  other  performance  factors  and  with  cost  and  schedule.  Under  these  con- 
ditions it  becomes  important  to  review  all  those  design  techniques  which  show  any  prox:ise  of 
improving  the  reliebllitv  otherwise  attained.  In  a riven  program  then,  those  techniques 
which  appear  t"  have  a high  ratio  of  reliability  yield  to  design  effort  can  be  adopted. 

RELIABILITY  REJUIREFhNTS 

Because  of  the  assertial  nature  of  strong  continuous  motivation  for  the  design  team, 
the  cu«tomer’s  need  for  reliability  must  be  thoroughly  understood.  Just  what  drives  his 
resul  rem*nt‘>  It  may  be  life  cycle  co«>t.  It  may  be  a special  importance  cf  high  product 
avellabil ity,  or  the  penalizing  cost  of  unavailability.  Reliability  ray  even  be  essential 
to  the  customer's  economic  surv:val.  Quite  likely  it  may  have  a specific  relati'nshlp  to 
the  profits  of  his  enterprise.  And  of  course  it  may  directly  threaten  the  existence  of  his 
project.  Reliability’s  role  may  be  obscurely  interwoven  with  maintainability,  survivability, 
safety,  or  o*h-r  eortiquouo  specialties.  An  understanding  of  all  relating  factors  is  vital 
to  optimizing  trades  b»'ween  reliability  an-*  other  cerfcrmarce  criteria,  and  maintainability, 
oroduclbP 1 tv,  schedule,  cost,  and  production  future. 

With  a valid  urderstanding  of  the  customer’*  need  for  reliability  as  a background, 
proposed  contract  co-mi tments , explicit  an*  inferred,  which  also  identify  related  rewards, 
penalties,  means  for  ’ater  adjustment  and  adjudication,  and  means  for  administering,  judging, 
and  policing  can  be  considered,  reviewed,  and  hopefully  finalized  into  an  efficient  workable 
contract  arran'ement.  Fundane  a*  it  may  seem,  the  contract  should  make  very  clear  what  ccr- 
stltutes  a failure  r levart  to  reliability.  Cnee  a contract  is  in  haiid  it  beco-ea  vital  tc 
identify  exactly  what  cortract  statements  srecify  reliability  requirements,  what  contract 
verbiage  must  be  ju’med  to  make  'urther  implication  concerning  reliability,  an-1  finally  just 
whet  contract  loop-holes  permit  exactly  how  ruch  reliability  flexibility.  This  total  infer- 
mat'or  should  be  both  broadly  disseria'ed  an*  accurately  understood  by  all  members  of  the 
'*e«ign  'mam. 

The  entire  development  organizaM-n  must  examined  to  verify  the  role  that  each  member 
will  nlav  in  or-»er  to  achieve  reliability  obj-e'ives.  It  is  essential  that  responsibility 
not  on’v  be  assigned  ar-*  acc»pted,  bu*  'hat  the  close  reletionship  between  design  responsi- 
bility for  achlevir,*  performance  r-qu  1 r-mep's  ard  for  achieving  reliability  requirements 
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(as  well  as  thoa«  for  maintainability,  survivability,  safety,  etc.,)  be  recogn*  j,  be 
appreciated,  and  be  efficiently  functional.  Furthermore,  in  an  overall  con'1  .ation, 
required  reliability  must  be  a basic  objective  of  an  authoritative  rnembe”  . management 
in  order  to  guarantee  that  attention  that  is  vital  to  its  achievement. 

CONCEPTUAL  DECISIONS  AND  RELIABILITY 

Many  conceptual  decisions  concerning  the  development  of  a new  complex  avionic  product 
are  made  both  consciously  and  subconsciously  lone  before  a customer  is  identified  and  long 
before  commitments  take  shape.  Many  if  not  all  of  these  early  decisions  affect  reliability 
in  a minor  or  often  major  way,  affect  the  maximum  quantitative  reliability  that  is  achiev- 
able within  the  state  of  the  art,  or  within  a practical  limited  extension  of  the  state  of 
the  art.  Unless  quantitative  reliability  receives  appropriate  consideration,  and  unless 
this  consideration  is  realistic  for  potential  customers,  much  development  time  and  expense 
may  be  lost  before  a satisfactory  product  emerges  from  the  development  process.  Once  con- 
ceptual decisions  have  been  made,  almost  any  change  thereto  is  very  painful  because  it 
becomss  major  redesign. 

Typical  conceptual  decisions  for  our  attention  are  the  following.  Analog  electro- 
mechanical design  may  be  supplanted  with  solid-state  digital  design.  Should  environmental 
control  of  avionics  be  achieved  with  hermeticlty,  with  multi-stage  cooling  and  heat  exchang- 
ers, or  with  conductive  cooling  dependent  on  external  environmental  den'en?  Should  the 
design  be  keyed  to  recently  developed  components  where  high  confidence  liability  experi- 
ence is  still  lacking,  or  to  older  less  ideal  components  whose  reliabi.  .y  is  known? 

Designs  keyed  to  components  which  do  not  have  multiple  sources  for  ready  availability  must 
be  assessed  for  reliability  risk  against  alternative  design  or  means  for  avoidance  if  the 
supply  pipeline  shuts  down  for  any  reason  during  production. 

Early  conceptual  decisions  can  often  be  made  which  provide  later  options  for  deciding 
approaches  to  reliability.  However,  during  conceptual  decision  making  someone  has  to  keep 
at  least  an  approximate  running  rough  estimate  of  the  reliability  to  be  expected  from  each 
alternative. 

RELIABILITY  ACHIEVEMENT  RISK 

Before  signing  a contract  for  development  with  a customer  who  insists  on  a quantitative 
reliability  requirement,  some  assessment  of  the  probability  of  its  achievement  must  be  made. 
If  the  development  will  be  chiefly  limited  to  prior  proven  and  well  understood  design  con- 
cepts, then  a total  understanding  of  all  performance  aspects,  all  operating  facets,  of  a 
closelv  similar  design  will  provide  the  best  estimating  background.  Especially  valuable 
will  be  current  exercising  of  a functional  model.  If  such  a background  is  impossible  then 
all  available  laboratory  data  pertinent  to  the  forthcoming  design  should  be  collected  and 
studied  in  an  attempt  to  squat'  theoretical  design  performance  and  laboratory  observation. 
There  is  ever  rresent  a significant  risk  that  total  hardware  functioning  is  not  totally  and 
completely  understood  and  that  laboratory  data  are  not  completely  relatable  tc  design  values. 
In  fact  one  frequently  finds  the  latter  portions  of  a design  being  accomplished  experimen- 
tally on  the  laboratory  work  bench,  even  with  cut  and  try  techniques.  Such  omissions  In 
theoretical  understanding  increase  the  risk  of  unexpected  failure  mechanisms  and  less  than 
expected  reliability.  The  desired  tota.  understanding  becomes  the  basis  for  identifying  the 
total  performance  requirements  and  the  probable  local  environment  for  each  piece  part  to  be 
employed  in  the  proposed  design.  In  turn,  reasonable  reliability  estimates  can  be  calcu- 
lated, required  reliability  apportioned  as  desired  to  concentrate  expected  difficultiee  in 
preferred  circuits.  Then  the  risk  of  insufficient  reliability,  or  conversely  probability 
of  needed  reliability  achievement  can  be  calculated. 

During  conceptual  decision  making,  the  manner  of  inserting  quantitative  reliability 
into  the  trade  decisions  requires  that  running  estimates  of  probable  reliability  be  main- 
tained. When  it  comes  time  to  assess  the  achievement  risk,  these  estimates  become  the  start- 
ing ooint,  and  they  are  updated  with  every  bit  of  refined  thinking  that  relates  to  total 
piece  part  performance,  total  local  environment,  and  operational  expectation.  The  selected 
piece  carts  with  their  refined  estimates  are  compared  to  expectations  from  available  (hope- 
fully multiple)  par's  sources,  and  adjustments  made  in  expected  failure  rates  if  necessary. 
From  these  failure  rates  are  calculated  reliability  values  for  functional  assemblies,  units, 
equipments,  and  the  overall  evstem.  End  figures  are  compared  with  customer  expectations, 
the  latter  is  broken  down  to  set  an  objective  for  each  portion  of  the  end  product,  in  order 
that  the  allowable  margin  between  expectation  and  requirement  can  become  known.  If  there  is 
little,  "r  no,  or  a negative  margin  between  expectation  and  requirement,  then  the  require- 
ment is  so  apportioned  among  the  various  units  of  the  end  product  as  to  assign  the  greatest 
reeds  for  reliability  improvement  to  those  places  in  the  design  where  the  expectation  for 
improvement  is  judged  greatest.  When  It  is  possible  to  go  through  this  process  before  a 
contract  is  signed,  final  contract  decision  can  take  into  account  the  expected  risk  of  relia- 
bility accomplishment.  Even  if  this  risk  assessmen*  cannot  be  reached  urtil  after  contract 
signing,  it  should  still  be  made  as  soon  as  possible  in  order  that  the  risk  guide  contract 
administration  and  later  contract  amendments. 

Risk  assessment  can  be  a process  of  continuous  refinement  from  the  tl-e  of  earliest 
design  consideration.  Rough  reliability  estimates  based  solely  on  approximate  parts  count 
are  excellent  as  a start  and  have  been  described  in  the  literature*.  The  degree  of  refine- 
ment thereafter  is  limited  only  by  the  degree  of  detail  available  concerning  rt  useage. 

ASSIGNMENT  OF  EARLY  FUNCTIONAL  DEVELOPMENT  MODELS 

Usually  development  contracts  identify  the  disposition  of  all  fabricated  functional 
models  of  the  end  product.  Accordingly,  prior  to  finalising  a development  contract,  careful 
thought  should  be  given  to  providing  for  reliability  study  in  the  assignment  of  early 
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functional  models.  Much  experience  seems  to  dictate  that  tha  first  final  configuration 
functioning  unit  off  the  production  lira  should  be  assigned  back  to  tha  development  labora- 
tory. This  unit  should  be  operationally  scrutinized  with  utmost  care  to  verify  that  every 
portion  of  every  circuit  properly  functions  exactly  as  expected  for  all  variationa  of  envi- 
ronment (electrical,  and  non-electrical,  and  in  the  total  system)  and  for  all  modes  of 
operation.  If  this  is  not  so,  then  complete  understanding  rust  be  achieved  for  tha  func- 
tioning observed  and  appropriate  revision  made  to  earlier  theory  so  that  expectations  are 
then  validated.  This  means  that  the  laboratory  must  have  a suitable  environmental  chamber, 
dedicated  instrumentation,  and  replacement  aasembliea  available  as  needed,  With  any  degree 
of  modem  avionic  system  complexity,  several  months  will  elepso  before  unanswered  questions 
concerning  the  new  design  begin  to  be  worked  out.  Further,  the  crew  assigned  to  this  inves- 
tigation must  be  rendered  free  from  other  priorities,  and  must  have  ready  access  to  all 
portions  of  the  development  team  in  order  to  rapidly  resolve  misunderstandings  and  diffi- 
culties. Progress  must  be  monitored  on  a daily  basis,  and  management  assistance  provided 
for  adequate  support.  Note  that  essentially  all  of  the  testing  performed  on  this  first  unit 
should  be  verification  of  early  subassembly  development  tests  and  their  findings.  Under  no 
circumstance  should  large  surprises  because  of  enexpected  difficulties  at  environmental 
extremes  be  expected.  Obviously  encountered  failures  should  receive  prime  attention  and 
this  attention  should  not  be  relaxed  until  a complete  understanding  of  the  correct  failure 
mechanism  is  acquired. 

The  second  production  model  off  the  production  line  is  usually  demanded  by  the  customer 
for  form,  fit,  and  function  study.  If  this  is  so,  then  the  third  production  unit  (at  the 
latest)  should  be  assigned  (for  six  months  cr  more)  to  reliability  assessment.  Some  care 
should  be  exercised  with  this  unit  to  avoid  introducing  any  failures  non-relevant  to  relia- 
bility determination.  An  operating  profile  consistent  with  later  official  reliability  veri- 
fication should  then  be  established.  The  prime  objective  of  the  testing  exercise  for  this 
third  unit  is  to  1)  uncover  design  shortcomings  and  oversights  pertinent  to  reliability! 

2)  identify  workmanship  problems  and  inspection  difficulties!  3)  spotlight  parts  selection 
shortcomings  including  omitted  specification,  insufficient  inspectir  inadequate  source, 
and  n'*d  for  bum-ini  4)  expose  fa'lure  mechanisms  of  those  failures  «hich  possibly  will 
not  be  easily  permanently  eliminated!  5)  provide  indication  of  probable  reliability  varia- 
tion among  otherwise  similar  future  production  units!  and  6)  indicate  the  reliability  and 
reliability  variation  to  be  expected  for  various  options  of  design  remedy.  The  progress 
made  with  this  reliabilitv  test  model  may  suggest  great  value  for  an  cption  for  assigning 
additional  early  models  to  reliability. 

FAILURE  MODE,  EFFECT.  AND  CRITICALITY  ANALYSIS.  (FFECA) 

Failure  mode,  effect,  and  criticality  analyses  have  been  amply  described  in  a prior 
report1.  Such  analyses  deserve  -enticn  at  this  point  because  it  is  important  to  begin  them 
immediately  after  signing  a development  contract.  Initial  analysis  effort  should  be  based 
on  considerations  that  went  into  conceptual  design  decisions  and  early  reliability  estimates, 
so  that  if  errors  in  these  estimates  are  to  be  uncovered,  modifications  can  be  considered  at 
the  earliest  possible  moment.  These  analyses  should  be  made  by  those  responsible  for  design 
in  order  that  they  recognize  the  effect  of  their  design  decisions  on  reliability.  Assist- 
ance from  reliability  specialists  is  valuable  provided  the  designer  la  not  decoupled  too 
far  from  the  analysis.  The  FKECA  should  be  revised  and  up-dated  on  a continuous  basis  as 
design  details  are  resolved  and  as  parts  sources  are  identified  and  test  data  acquired, 

PIECE  FART  PROCUREMENT 

Inevitably  every  development  will  include  a few  or  manv  long-lead-time  procurement 
parts  and  components.  Because  of  need  for  this  long  lead  time,  occasion  will  arise  when 
subcontracts  and  purchase  orders  are  placed  immediately  upon  signing  the  development  con- 
tract. Thus  there  is  i-portant  early  homework  to  accomplish  in  the  procurement  area  in 
order  to  protect  the  achievement  of  high  reliability  against  the  pressure  and  sequence  of 
tight  development  schedules. 

A number  of  recommendations  are  to  be  made  in  t^is  section  for  close  scrutiny  of  piece  * 

part  sources,  wont  of  these  recommerds tiers  aptly  regardless  cf  whether  the  preferred 
source  is  a aubaidiary  of  -he  developer’s  organization,  even  a contiguous  department  in  his 
orrani t atlnn,  or  an  unknown  manufacturer.  Uiven  a choice,  the  beat  aource  la  likely  to  be 
a stable  organization  with  a long  hist-ry  in  its  product  line,  and  a long  history  of  very 
satisfactory  rrncure-ent  relationships  for  Fast  development  programs.  In  this  ideal  situ- 
ation there  is  little  need  to  study  the  source  organization  especially  .'or  the  current  pro- 
curement need.  At  the  other  extreme  is  the  situation  where  the  source  organization  has  had 
no  previous  contact  with  the  developer,  and  has  not  previously  marketed  (to  any  significant 
extent)  *he  i*em  to  he  procured. 

Because  more  than  a single  source  should  be  identified  and  verified  for  every  procure- 
ment item  going  into  a high  reliability  development  program,  all  likely  sources  for  the  tvpe 
cf  riece  rerts  and  materials  eusto-arily  used  in  typical  developments  should  be  extensively 
surveyed  rricr  to  any  specific  procurement  requirement.  An  adequate  survey  made  by  a team 
from  the  developer’s  organization  should  view  ard  review  the  subcontractor  or  piece  part 
manufacturer  and  his  facilities  with  an  experienced  eye  with  respect  to  adequacy  of  design 
capability  (versus  state  cf  the  art),  adequacy  of  quality  control,  reliability  awareness, 
research  background  and  design  evaluation,  rermaneney  of  optimum  design  techniques,  pro- 
ducticr  caraM1 ity,  cost  ard  schedule  per 'orrance , personnel  stability  and  longevity,  labor 
relations,  and  financial  solvency.  While  these  criteria  mav  seem  remote  from  reliability, 
anv  ir.teruction  i-  procurement  during  rro^ucticn  leads  to  substitutions  and  the  need  to 
re-evaluate  *he  reliability  of  the  developed  product.  Prospective  sources  for  piece  tarts 
who  rate  highly  ir  the  survey  but  he  e not  rrevicuslv  supplied  the  developer  should  be  given 
trial  rreeu-ements  for  at  l»^st  partial  verification  of  the  survey  findings. 
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History  contains  many  instances  of  reliability  difficulties  that  have  arisen  and  then 
been  trac'd  to  lack  of  tieht  control  of  a procured  piece  part.  No  specification,  practi- 
cally speaking,  will  spell  out  in  detail  every  characteristic  vital  to  a coaplex  system. 
Actually  procurement  specifications  with  special  language  specify  certain  critical  param- 
eters. Other  parameters  are  covered  by  standard  specification  practice  (fine  print).  Still 
other  factors  are  implied  by  customary  procurement  practice.  And  finally,  inevitably  a few 
factors,  nowhere  specified,  are  established  by  habit  or  the  custom  of  the  piece  part  manu- 
facturer. This  looseness  of  specification  is  usually  found  at  every  level  of  procurement. 
Thus  the  piece  part  manufacturer  has  only  semi-complete  control  over  the  sources  of  his  raw 
material.  He  may  be  forced  to  change  sources  and  in  all  good  conscience  establish  to  his 
own  satisfaction  that  his  new  source  provides  everything  needed  and  previously  provided  by 
the  old  source.  Surprisingly  these  substitutions  often  lead  to  difficulties  and  all  con- 
cerned then  learn  of  unknown  dependence  on  unspecified  parameters. 

Standardisation  of  piece  parts  to  be  employed  in  development  while  never  completely 
inclusive  is  a great  asset  for  source  selection  philosophy.  For  instance,  proper  control 
of  procurement  of  high  reliability  parts  nearly  always  requires  a specification  end  special 
drawing  by  the  procuring  developer  in  order  to  not  only  specify  any  parameters  overlooked  by 
a standard  specification,  but  to  identify  precise  acceptance  inspection  '-equiremor.ta  (in 
terms  of  both  source’s  and  developer's  test  and  inspection  facilities)  and  statistical 
acceptance  plans  if  acceptable,  reliability  evaluation  requirements,  basis  for  rejection 
and  return  for  credit,  constraints  on  material  substitution,  bum-in  if  any  and  other 
special  screening. 

CIRCUIT  DESIGN 

At  the  top  of  the  list  of  high  reliability  considerations  for  circuit  design  i3  the 
need  for  a standard  rarts  list  (SPL)  or  handbook  and  a rigorous  authoritative  organisation 
for  its  control.  While  the  gradual  acquisition  of  preferred  parts  for  inclusion  In  the  SPL, 
based  on  successful  experience,  is  perhaps  the  most  painless  means  for  the  creation  of  an 
adequate  SPL,  other  short-cut  means  have  been  quite  effective.  One  such  means  is  the 
following. 

With  appropriate  anticipatory  language  in  subcontracts  and  purchase  orders,  a Parts 
Control  Board  (PCB)  composed  of  a chairman  from  the  developer’s  organization,  and  a parts 
specialist  (member)  from  each  significant  supplier  is  organized  and  begins  its  meetings  on 
a frequent  (monthly)  schedule  immediately  upon  award  of  the  development  contract.  The  PCB 
by  majority  vote,  but  with  the  chairman’s  power  of  veto,  agrees  on  a preliminary  SPL  that 
is  to  govern  all  suppliers.  Any  additions  (and  deletions)  to  the  SFL  are  made  subject  to 
discussion  and  vote  bv  the  PCB.  Any  and  all  piece  parts  to  ve  used  by  the  developer  or  any 
subcontractor  must  either  be  placed  in  the  SPL,  or  te  specifically  approved  by  the  PCB  for 
the  singular  use  and  effectivity  upon  which  the  vote  is  taken.  Often  special  verification 
tests  are  demanded,  and  later  experience  may  then  warrant  inclusion  in  the  SPL.  The  col- 
lective experience  and  intelligence  brought  together  by  the  PCB  leads  rapidly  to  a practical 
SPL.  The  frequency  of  PCB  meetings  is  adjusted  to  needs  and  early  reduction  in  meeting 
frequency  is  expected.  The  desirability  for  special  drawings,  special  tests,  and  acqui- 
sition of  special  data  can  be  reviewed  by  all  and  discussed.  Above  all,  the  parts  sources 
then  readily  recognize  the  pervasive  Importance  of  reliability  in  the  mind  of  the  developer. 

The  next  most  important  consideration  for  high  reliability  circuit  design  is  circuit 
analysis.  In  this  computer  age  much  has  been  done  toward  standardized  computer  analysis 
of  electronic  circuits.  Initially,  it  is  well  to  note  that  if  there  is  to  be  anything  like 
an  extensive  investigation  of  an  electronic  circuit,  a design  which  minimizes  the  number  of 
different  tvpes  of  circuits  (maximizing  the  repetitive  employment  of  a minimum  number  of 
circuits)  will  both  ease  the  analysis  burden  and  increase  the  likelihood  of  total  evaluation 
of  the  circuits  used.  The  design  of  large  scale  digital  computers  has  been  a classic 
example  of  an  extremely  complex  large  system  which  employs  an  amazingly  large  quantity  of 
but  a few  different  circuits. 

Computerized  circuit  analysis  begins  with  the  creation  of  an  accurate  equivalent  cir- 
cuit. The  value  of  all  subsequent  results  will  be  heavily  dependent  uron  the  assumptions 
employed  in  claiming  accuracy  for  the  equivalent  circuit  used.  The  writing  of  circuit 
equations  to  cover  circuit  performance  in  terms  of  rarts  parameters  can  benefit  today  from 
the  increasing  emphasis  on  mathematics  brought  ahout  by  the  computer  age.  The  circuit 
equations  will  usually  incorporate  into  one  or  another  of  various  existing  general  computer 
rrograms,  which  can  then  be  debugged,  run,  and  the  co-ruter  output  analyzed. 

Because  programmed  circuit  analysis  bv  computer  reiuires  as  inputs  various  voltsees, 
values  of  resistors,  capacitors,  parameters  for  transistors  and  integrand  circuits,  and 
the  like,  it  is  convenient  t-  introduce  therein  initial  tolerances,  value  variations  with 
temperature,  humidity,  and  life,  and  all  the  diift  and  aging  factors  that  affect  proper 
functioning  of  the  circuit. 

Worst  case  analysis  is  made  wh-n  all  circuit  parameter  values  for  computer  input  are 
simultaneously  chosen  at  those  tolerance  and  drift  extremes  that  abridge  proper  operation 
the  most.  Worst  case  design  is  achieved  ir  desired  functioning  prevails  with  such  extremes 
of  parameter  values.  Obviously  the  frequency  with  which  a repetitive  circuit  configuration 
is  repeatedly  employed  in  an  overall  sys’em  can  provide  strong  influence  in  the  direction 
of  worst  case  design. 

Studies  have  been  made  wherein  the  statistical  distribution  of  tolerances  is  considered 
so  that  calculation  of  the  probability  of  proper  operator!  can  be  made  for  something  less 
than  worst  case  design.  However,  it  is  usually  found  that  with  highly  replicated  circuit*. 
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the  savings  In  circuitry,  space,  weight,  power  requirement,  and  cost  is  minor  for  statis- 
tical design  over  worst  case  design  when  compared  with  the  rapid  drop  in  reliability.  The 
great  advantage  of  worst  case  design  (other  than  its  greater  reliability)  is  that  it  can 
be  performed  with  a minimum  of  parameter  design  information,  ard  it  avoids  need  for  assump- 
tions or  voluminous  data  for  the  assignment  of  statistical  distributions  to  the  tolerances 
and  drifts.  In  any  case,  the  opportunity  to  explore  circuit  function  as  parameters  are 
varied  through  use  of  a programmed  computer,  can  provide  tremendous  in3ight  toward  effective 
total  understanding  of  the  design  of  high  reliability  circuits  ar.d  thus  high  reliability 
avionics. 

The  need  for  useful  tolerances  for  the  parameters  of  piece  parts  is  easily  accommodated 
for  parts  that  have  been  in  regular  high  volume  use  and  procured  from  steady  sources.  On 
the  other  hand,  new  items,  or  simifieant  changes  to  old  items  can  raise  new  questions  as  to 
expected  tolerances.  While  collection  of  quantities  of  measurement  and  test  data,  painful 
as  it  may  be,  is  undeniably  most  valuable,  a first  hand  understanding  cf  the  part  manufac- 
turer's production  process,  in  detail,  and  especially  if  it  is  highly  mechanized,  can  permit 
the  specialist  to  make  quite  useful  assumptions  as  to  tolerances,  with  at  most,  abbreviated 
test  and  measurement  of  selected  parameters  on  small  samples. 

If  second  and  third  sources  for  various  oiece  parts  exhibit  parameter  tolerances  or 
drift  b»havlor  markedly  different  than  the  preferred  source,  the  computer  analysis  program 
can  quieklv  evaluate  the  effect  on  circuit  performance,  and  thus  verify  the  adequacy  (or 
inadequacy!  of  selected  alternate  sources,  and  possible  remedy. 

LAYOUT  DEVELOPMENT 

The  remarkable  progress  in  solid  state  development  of  large  scale  and  medium  scale  inte- 
gration has  the  effect  cf  compressing  more  and  more  avior.ic  complexity  into  smaller  and 
smaller  volume.  The  lower  power  requirement  of  solid  sta*e  active  circuit  elements  no 
longer  protects  the  designer  against  cooling  problems.  Means,  and  preferably  skillful 
efficient  means,  for  heat  removal  must  be  considered  from  the  very  beginning  of  conceptual 
design,  and  attention  to  this  dare  not  be  relaxed  until  hardware  models  permit  valid  meas- 
urements of  temperatures  and  thermal  gradients  un-’er  all  possible  conditions.  Unmistakable 
evidence  as  to  the  adequacy  of  cooling  must  be  developed. 

The  coolirg  problem  must  be  addressed  not  only  for  system  operation  in  the  intended 
application,  but  also  for  operation  during  all  levels  of  maintenance,  for  accidental  unin- 
tended operation  in  conjunction  with  other  repairs,  and  for  emergency  checking.  The  cool- 
ing problem  must  be  considered  for  all  possible  environments  from  tropical  summer  to  arctic 
winter  (if  that  deployment  is  possible).  If  cooling  under  seme  conditions  such  as  during 
maintenance  force  dependence  on  auxllllary  units  (viz.,  portable  refrigeration  units),  the 
reliability  of  these  auxllllary  units  must  be  sufficient. 

If  fooling  is  by  air  flow,  then  extremes  of  air  density,  flow  rate,  humidity,  thermal 
gradient,  and  carried  centamirstlon  must  all  be  considered.  Air  flow  cooling  raises  the 
need  for  a decision  on  what  portions  of  the  design  to  make  hermetic  co  protect  against  con- 
tamination. If  cooling  is  by  a liquid  refrigerant,  can  all  the  important  thermal  gradients 
between  the  cooling  liquid  and  the  most  distant  sensitive  piece  part  be  adeeuately  estimates? 
Are  those  temperature  tolerances  essential  for  proper  effectiveness  of  the  coolirg  air  or 
llquit  really  practical?  Can  they  be  adequately  estimated  for  all  conditions  of  operation 
of  the  system? 

Mathematical  computation  of  heat  flow  is  complex  but  extremely  valuable  if  the  needed 
parameters  are  known.  The  thermodynamics  involved  with  dense  avionics  becomes  so  sophis- 
ticated, that  a successful  design  is  only  considered  achieved  after  thorough  laboratory 
measurement  of  an  extremely  accurate  and  representative  operational  model.  Accordingly, 
hardware  models  of  proposed  cooling  designs  are  often  the  earliest  items  for  model  shop 
fabrication,  and  adequate  environmental  test  facilities  for  such  models  often  see  contin- 
uous assignment  to  cooling  problems  from  beginning  to  end  cf  the  contract. 

Many  reliability  problems  have  arisen  because  a new  design  was  not  properly  evaluated 
during  non-operating  exposure  to  low  temperature  extremes.  Failure  mechanisms  related  to 
inermal  exrarsion  and  contraction  and  the  rate  of  expansion  and  contraction  are  too  often 
everlo-ved.  The  mechanical  effect  of  start-up  after  extended  cold-soak  can  easily  be  ob- 
served once  the  hardware  exists,  but  difficulties  found  so  late  in  the  development  program 
are  /suallv  mo-t  inconveniently  dealt  with. 

Susceptability  to  shock  and  vibration  usually  is  controlled  in  large  part  by  the 
designer’s  cast  exr»ri»nce.  However,  with  the  expansion  of  other  horizons,  has  come  expan- 
sion of  tbe  shock  and  vibration  spectrum  that  can  sometimes  be  encountered.  Specialists  in 
shock  and  vibration,  if  they  are  given  the  opportunity.  Time,  and  funds  to  design  suitably 
representative  tenting  fixtures,  end  if  they  have  necessary  laboratory  exciters  and  sensors, 
can  do  quite  well  in  evaluating  system  performance  in  a shock  and  vibration  environment. 
Amain,  bv  the  t'me  such  evaluation  can  occur,  development  prepress  is  far  beyong  the  con- 
venient roint  for  structural  remely.  The  answer  is  to  investigate  mechanical  design  early 
through  slmula*ion  and  simplified  models,  to  augment  Fast  experience  to  the  extent  necessary. 

FAILURE  ASA1YSIS 

Laboratory  facilities  adaptable  to  the  study  of  any  t vee  of  system  failure  should  be 
established  close  bv  the  •'ev-lopment  laboratory.  These  facilities  ahold  then  be  employed 
to  establish  or  verify  the  rhy*ies  of  failure  in  every  ins*ance  of  observed  failure  where 
such  understanding  does  rot  positively  exist.  It  is  only  with  recognition  of  the  detailed 
failure  m»chanis»  that  decision  can  be  made  as  to  the  value  to  reliability  of  its  elimin- 
ation. Because  manv  of  the  clues  needed  for  effective  failure  analysis  exist  only  at  the 


r-'". r.t  «f  failure,  and  in  the  mind*  of  there  i-  -irvlrir  the  fiilure,  it  it  »«i«»r  t;al  tt.it  the 
teas  operate  cn  por  tt  l v*»i  v 1-  *h’  i lure  s'alvsia  rro'-nt.  it  n ■»  » 1 y of 

ittle  benefit  • r a»nd  a r 1 1 r-*  . t--*"  birk  to  it"  ' ar  ufao  t ure  r f or  failure  apalvsia,  lr  large 
ift  heo*use  the  motivation  is  wrongly  diree’ed  then.  if  «smntl*s  bec"~e  otstacl»a,  tf  *-r. 

to  invite  those  ret  t'  on  niM«  to  fn*i>  to  t h»  f a 1 1 ,re  V tl  i>l»  1 a h -ra  • "TV  ‘eat  it 
li'tnont  to  the  site  failure  and  to  aotlvelv  i»rform  th»  aralvsia  there  (rather  tt  a-  1 ■ 
■t"lr  own  'facility)  in  co  1 1 abort  * 1 • n with  *he  deve  1 op\r-*nt  team. 

Industrial  »«n,ri»nf,t  ha«  shown  that  an  effective  failure  v'a’v'ii.i  let-oratory  *-,at 
l-Clu’e  op  hive  local  access  to  facilities  for  radlographic/x-ray  study,  » i oprac  py , pho- 
toorerhv.  Chemical  analysis,  apd  comnlete  eleo'rlcal  mechanical  measurement  in  write 

room  environment,  A rrr  opr  i s ‘e  funding  miiet  evict,  b'-esu-e  failures  cannot  be  sel»C'.7*’y 
a-alv?*d  a limited  b--deot,  ’’seful  analyses  'eiti'-;  to  a useful  report  of  p-ro  l ; -ps 

average  between  twenty  anrl  one  hundred  marhn-irs  each. 

While  it  is  quite  eurtema-v,  it  is  still  important  tn  mertion  the  necessity  tn  veep 
thoro-ioh  dats  files  of  observed  failures,  from  the  very  beginning  of  development  orward, 
kanv  schemes  for  achieving  this  by  computer i ted  methods  ► ave  teen  descrired,  >»  sriroiple 
value  is  to  1)  quickly  reccvor  east  data  or  similar  or  atpar-Ttlv  ai-ilsr  fallur»a  ar.d 
failure  mecha-isns,  and  ?)  to  develop  at  least  a rough  index  of  th»  reliability  cr  cr-tara- 
tive  relia'-ility  to  b»  expected  for  ‘he  failed  item. 

yUMAWO  HiriH  PKUAPI1  1TY  PtyUjlN 

l»rhara  the  -rest  tvrical  method  for  management’s  contr'1  of  a develrpment  tro-rsm  is 
via  aP  s i en  reviews.  before  discussing  design  reviews,  let  us  ick  at  possible  -eans  for 
the  leaders  of  the  development  team  (rathor  than  non-technl cal  -anaem-nt)  to  beep  t'em. 
selves  up  to  date  and  to  properly  advise  lower  echelon  mom' ers  of  their  team. 

Farts  application  data  sheets  can  be  desirnod  to  Veer  running  account  cf  essentially 
all  important  application  information  ( including  derating)  for  every  piece  tart  to  enter 
design  consi dera t i on . Tvrical  data  sheets  have  alreadv  been  described^.  Ttese  data  sheets 
at  first  e.ance  may  seem  to  constitute  considerable  extra  work  for  a circuit  designer. 
However,  on  closer  inspection  it  will  be  found  that  essentially  all  the  data  for  entry  are 
'’ata  that  the  designer  already  must  possess  if  he  Is  to  make  a favorable  decision  on  the  use 
of  a -articular  piece  part.  The  data  sheet  just  conveniently  collects  in  one  location  on 
a routine  format  these  data  otherwise  often  existing  on’y  in  the  designer’s  notebook,  or 
only  in  b • head,  and  sometimes  given  a pr-orietarv  cloak  of  secrecy  by  him  until  h»  can 
v»rify  ‘he  wisdom  of  his  choice.  When  such  rar‘«-  application  da‘a  sheets  are  roitinely  kept 
bv  all  circuit  designers,  and  kept  up  to  date,  supervisory  denim  personnel  can  review  them 
on  as  frequent  a basis  as  seems  necessary  wi+hout  tyinp  up  the  circuit  designer  with 
questions.  Concurrently,  those  with  responsibility  for  reliability  can  also  review  the 
application  data  sheets,  and  therefrom  rake  preliminary  calculations  to  indicate  trends  and 
expected  problems. 

Design  reviews  for  the  benefit  of  supervisory  design  personnel  (and  not  higher  manage- 
ment) should  be  held  periodically  and . frequently . Care  has  to  be  taken  with  respect  to  those 
Invited  to  be  the  audience,  and  with  respect  to  those  Invited  to  offer  critiques  and  criti- 
cisms, to  make  sure  the  responsible  designer  does  rot  withhold  early  considerations  for  fear 
of  criticism  or  of  appearing  to  exhibit  stupidity.  A true  team  atmosphere  rather  than 
encouraged  competition  among  designers  will  go  further  to  yield  high  reliability.  Homework 
should  h*  assigned  In  advance  of  a design  review  so  that  ether  unrelated  impartial  designers 
without  conflict  cf  Interest  can  study  to  their  own  satisfaction  those  portions  of  a benign 
biased  ready  to  release  (or  under  criticism  for  some  difficulty),  and  then  report  their 
finding*  or  conclusions  at  the  design  review.  It  is  important  to  realise  that  design  reviews 
are  rot  an  element  of  the  reliability  program,  but  rather  a tool  for  technical  management 
for  sound  overall  t"Chnical  dosin',  ard  any  reliability  1-provement  that  results  is  because 
of  *he  soundness  of  the  resulting  design  rather  than  because  of  what  took  place  in  a design 
roview.  1 

Because  upper,  non-t,echnleal  mana-ement.,  as  well  as  customer  personnel  usually  have 
Interest  in  the  desien  review  as  a m|.>an*  for  monitoring  design  pro-rees,  it  is  customary  to 
identify  a spociflc  limited  number  of  full  dress  design  reviews,  to  be  held  at  particular 
program  mileposts,  and  t.o  open  these  reviews  to  all  interested.  With  proper  planning,  the 
design  team  can  pre-lnsure  at  least  to  a large  extent,  the  favorable  presentations  that  will 
be  made  in  these  formal  design  reviews,  and  can  use  their  own  more  frequent  Informal  closed 
reviews  to  rrovlde  opportunity  for  dress  rehearsal. 

FI°NT  KhOlNKHRINO  ITPEIS 

As  the  design  approaches  the  poikt  where  first  models  can  be  ordered  from  the  m-del 

• hop,  the  design  should  be  eloselv  reviewed  hv  inspection  and  quality  control  specialists, 

as  well  aa  those  responsible  f-r  fabrication  methods.  Not.  only  must  it  !e  possible  to  fabri- 
cate a model  that  satisfies  the  designer  with  respn-t  to  Its  representation  of  his  design 
intentions,  but  It  must  also  be  possible  to  efficiently  inspect  the  mgterlalr  and  tarts 
goin»  irto  the  fabrication,  as  well  as  the  assembly  process  ->-  it  takes  place,  A any  designs 
have  so  hurled  early  assembly  rper.a'ioif  under  la'er  asse-t  ] . . *» -t  when  lu-stlcnatle  per- 
forator raiser,  doubts  an  to  proper  fabrication,  disassembly  > * ; .ire-d  to  verify. 

Frlrr  to  the  arrival  o'  soils  ««-.*»  eleotrrrion.  It  war  r'Ui  sit'.e  to  trradb-nrd 
ear'v  de-ten  reps 1 d»ra  • i - pa  so  ‘Oat  mr-t  all  vi*nt  I'M  were  nrarerrO  a<  d Oerlalopr  eaJe 
be’-re  fstr'r»tiom  rr  s ,h-x  r°tre-e  r *ee  »t,  -erhatloel  deri,*r-.  While  t * . adboard  log 

• 'ill  eviata,  “-ere  i«  ap,  ev-r  lrrr.’«lM  r*  aam  be»weer  brnadhripo  i»rffr*’r'e  »rd  »be  pe  r * 
Nr*'"*  ot  a repre-erta*,  ve  er--iteerirg  '-del,  Tb-i-,  wh.l*  -rre  .r',lcatt--r  -?  ■*,Mrr 


adevisry  orn  b*  rained  fmr  a br»a-4,“4ard  ^>■<*•1,  ar4  pi  re  fr  or  a trarrb'ard  W'i*el,  cea.rr. 
adeviarv  for  fp  1 t »*■  11 1 ♦ v * h<"  1 lttl*  va  1 jp  t r 1 r r to  the  r f a *r’  ly  rep- 

re  *»n  • a t t ve  »'f  I'ff  rl'f  * ><*1  ■ * * he  dr  i i fti  a a It  ip  e » t * r t • if  to  t*  released  f ' r | rf*  ,r  ! 1'  r 

toollrr,  In  f » p*  r<  1 ability  verification  r ar  1 v b*  } jr  a 1 1 or  #4  ur  1 e »a  it  tat  - a | i a<  » 

or  a '<n  ( t fabricated  frnp  tro^uct  lor  t'fllrr. 

The  reed  fnr  a near  final  mdel  fnr  r»’lt*lltty  rt  ar  d th*  t ««;tle  mi  i*  .‘i 

rf  de  a 1 rn  fhtr»p  tht  Pay  r*")'*  fr  • nov't  rr  le»s  than  aati*fars  rv  aaaeaspert  tp'i'f*  a 
Claaalf  nnrflint  th*t  r'rfrrrta  *h»  appj’npr.  In  p r i*i»*  fnaaiMp  orl'lclae,  ar  4 addr4 
Mt«r<<  ar  d o,  iiiy  ;rr  rtn*  b v r*l  i'1  I M tv  ir"’i*Mi  1"  4he  |,Mirrn,r  • o f>v  t nr  u - 1, 

a#«irn  ar1*  hirh  reliability  a«  e-.rh  a«  la  pjparlv  ''a«lMe  in  every  early  dr'iei^n  r»  a>p«, 
Duf ; r f the  *ar  y early  v-riMcatl.-  a t e 4 a t e t vp  a i r 1 nr  4 n p»j«*prrp  r * ra  r re  - rr  * a * . /r 

rlral  t-«r,,»tr*l  hr  •■ul<*  rar»fill  • nr!">»  pv»rv  a"»»lv,  »v»rv  «iU>'.'n  *’*r*  h i • 'f»r* 

va  M -n  d or  a rot  a i*  -r  e with  ► * rtfr''44*--4#  - n y * ♦ y tyt-4hp-p«  *rryl(*  t r •>  e d • n y r 4 on 

wi  *h  de  ••  e l n pp  pt  t r > t hr r t h sr  o'  i^v  ar  r'  tyry^*-^,  ; t r r r d rru 1 ♦ 4 e 4 4 i * ,<"f- 

» : via  ;»  *n  a 1 » rite  port  and  prr»  4 • r »rrr;-»r  w n ^ >.r  **r»  1 . In  fa  t,  w . * h d - ♦ a . 1 e d ar  4 

p » t an  p i vp  arr ' : e4 ♦ 1 on  rf  1 1 r ae  r n ! • » 1 r 1 »* , • r p 4 p r f - r a • p if  4 v*  r • f 1 c • ' 1 ' r f p r t a • « . t 
prppr4Pr  rn  c-rorrn  t 4 thr  deiprrr# 

CC-  C’  l-"IPb3 

7hp  pprr'anh  to  nirh  rp'laMli’v  rtppim  dracritrd  n«rp»!*t  a'fp»i  t»  t"  idrrtify  hint, 
rr  1 1 aM  ’ tty  aa  an  lr^pfart  p]poirf  f‘t  fo'if  t c^ttrttrrrivt  t r.'-ro’./h  dr « 1 yr  # It  1 4 'tp 
a u t h if'y  p»rpri»rrp  4 r a ♦ njrt  ar  at44444h  ' 4 a 4 " t 4 ty»  d - rr 4 IpvpI  4 1 r*  ’ i**  1 : t y far  4 ' ' p 

•-ar  t 4 1 v ar4  * 1 ♦ h t e 4 ■*  - » y o r ■ p »i  af  a*  m troir^  «>.p  *-p  nippin'jlripa  ra,  r4  tv  itn***yr  'tint  r .t" 
a^4  rvprrlrhtp.  1»» 4 lrr  tc  ota»nat  Ip  fvt  irp»,  »rp  pIIpIu'p4  rrt  t‘  c'p  a«  f a 1 I urr  nt.y-r- 

va • t rr  l'4Pft!,l*P  p’ft  rrntl»P.  ‘or  rnp  trirr,  tfp  fail  irt  fi»  airrrarh  Pl)ri'«'p*  .Ut 

rn-  yrrv  ratl^Iv)  »t,p  fra  ua'tlv  rpr,.?ti-y  fa  ’ iro  "Pft'rurt,  but  rrr/i"p«  1 j * 1 1 ► ap«i«- 
tarrp  ?<*r  »hP  Pll»lra*i-n  r*  |rfr»1  :<rt  toilirp  p»rhar  i >-m« . ir  totay*'1  m-r]e»  ayatera. 

It  ir  Pta«  tr  literally  thrura-4r  of  itiffprmt  fa‘lir*  ppfMnafs  nort  if  »rirh  art 

,Pt«at»va  n r * pr  epntiph  *r  r»r*  it  pll'i'af  'r,  b-j*  wrjch  ir  total  trn*’irp  *ary  all  rtif'nrrrt 
'ail  :raa  with  attp-4art  low  npliabilltv  *ta>  itnp«  rot  rp*[rnit  to  C'j'tn- ary  rrliatllity  f r'»th 
fphnrl tuea. 

TbP  itaalrrpr  wh«  -r.rwp  tvtrv  farpt  of  all  hit.  jarta  ar<l  aatprlalc,  coatlr*Ply  unnrr- 
atan4a  thP  total  furet.'  r.lrr  rf  the  rirruitry  rp  tejirr,  ar 4 Its  pvrry  llPitatinr  ( art  ♦»# 
rwaaora  therrfnr)  to  obtairahlp  ippfnrpanop,  whP’i  allnwpo  a*  0 rr- lva*i‘r*  t r rrrduce  a care- 
ful rlpalm  wi  1 ’ rfalr  a»atP  rf  thP  art  rpliatilltv  in  rlrlr-.p  tlrp  and  eaferpe. 
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Design  t Electronic  Circuit*  and 
Corny., ,'nent  S*  l ction  for  High  Reliability 
by 
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LEVER,  Institu  'or  Satellite  Electron'cs 
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ABSTRACT 

for  high  reliability  application,  i ,les  are  given  for  the  selection  of  component*. 
Determining  the  suitable  technology,  part  derating  factor*  and  then  the  selection  or 
writing  cf  rpecif  icat  ion*  for  paits  procurement  are  described.  The  necessity  of  pre-cap 
visual  inspection  and  screening  of  compc  ent*  as  well  a*  Incoming  inspection  by  the 
user  for  high  reliability  applications  . emphasised.  The  use  of  plastic  IC's  for 
Hl-HEL  apflications  and  a new  deve lopme  it  in  this  field  Is  discussed. 

The  second  part  is  concerned  with  the  design  of  reliable  circuits.  Precautions  to 
be  taken  against  voltage  and  current  overstressing  and  the  selection  of  the  proper 
supply  voltage  are  described.  The  use  of  MSI  and  LSI  and  synchronous  operation  Is 
suggested  to  increase  the  reliability.  Noise  immunity  and  lta  Influence  on  reliable  operation 
is  discussed.  Finally  redundancy  versus  screening  and  the  cost  of  reliability  are  considered. 

t.  INTRODUCTION 

The  first  thing  to  do  In  the  design  of  an  electronic  circuit  is  to  establish  the 
requirements  of  the  mission  and  the  anticipated  environments.  Then  one  can  define  the 
components  compatible  with  the  circuit  parameters  and  the  environment.  In  the  following 
guide  lines  are  presented  which  are  intended  to  help  in  the  selection  of  components  for 
high  rellaoility  applications.  In  a second  part  circuit  design  rules  for  reliable 
operation  are  given  based  on  problems  which  are  frequently  encountered.  Some  basic  prin- 
ciples important  for  reliable  circuit  operation  are  presented  with  emphasis  on  active 
semiconductors  because  most  of  the  problems  encountered  are  connected  with  these. 

2 . COMPONENT  SELECTION 

2.1.  CHOOSING  THE  RIGHT  TECHNOLOGY 


For  the  selection  cf  a suitable  technology  one  has  to  know  the  requirements  of  the 
application  and  the  environmental  conditions  first.  Table  I gives  for  instance  the 
standby  power  dissipation  of  several  families  of  IC's.  Fig.  1 gives  the  dependence  of 
the  power  dissipation  on  the  operating  frequency  and  also  the  maximum  frequency  of 
operation  for  these  IC's.  One  has  to  take  care  that  both  in  the  power  dissipation  and 
the  maximum  operating  frequencies  including  aging  and  component  tolerances  there  is 
still  enough  safety  margin  that  the  application  can  be  implemented.  This  will  be  dis- 
cussed in  more  detail  in  the  paragraph  on  part  derating  factors. 

Table  I:  Standby  Power  for  Several  Technologies 


Digital  Logic  Type 

Standby  Power 
Drain  / Gate 

CMOS 

1 ,uW 

PMOS  (Static) 

0,5  mW 

PMOS  (Dynamic) 

50/uW 

DTL 

4m.W 

TTL  (5s  series) 

lOmW 

ECL  1 I'J  K ser  los  > 

2 5mW 

/ 


Moat  important  than  la  to  choor*  a technology  th*  reliability  of  which  haa  been 
proven.  Thla  can  b*  verified  by  usirq  Mu  Standard  or  space-qualified  components.  It  can 
for  new  devlcea  also  be  done  by  performin')  llfe-tlme  teata  oneaelf  and  by  evaluating  the 
quality  of  the  component  a to  be  uaed  by  the  meana  of  deatructlve  phyaical  analyala  aa 
will  be  deacrlbed  in  the  paper  on  Reliability  Teatlng  of  Electronic  Parta.  In  any  caae 
however  it  la  moat,  important  to  procure  the  parta  to  definite  aped  f icat  Iona . 

2.2.  WRITING  AND  SELECT  INC  SPECIFICATIONS 

If  possible  parts  ahould  be  procur«'d  to  already  existing  Hl-REL  apeci  f icat  lonn 
such  as  MIL-Sp'oc  1 f icat  ions , GfW  or  HAE  sp>ecl  f Icat  Iona  . This  almpllfles  the  procutement 
of  parts  because  the  manufacturer  already  haa  test  facilities  and  programs  ready. 

If  a part  shall  be  procured  to  a new  specification,  the  user  should  negotiate  with 
the  manufacturer,  aometlmes  a minor  chanqe  can  result  In  a considerable  price  and/or 
lead-tir.ie  advantage.  For  mission  critical  parts  SEM  quality  evaluations  on  samples  of 
one  lot  may  be  required  [l]  . All  the  inspections  and  tests  done  by  the  manufacturer 
must  be  performed  to  documented  procedures.  Included  in  the  specs  should  for  critical 
parts  be  the  pre-cap  visual  inspections  by  an  independent  inspector  after  the  component 
r.anuf acturer  has  completed  his  inspections  (see  below).  Also  the  witnessing  of  a 
critical  parameter  test  may  be  called  for. 

In  NOS  and  linear  devices  a test  of  the  input  protection  system  may  be  necessary 
because  as  will  be  shown  a lot  of  failures  are  due  to  electrical  overstress ing  at  the 
input.  The  specified  burn-ln  time  varies  very  much  between  spied  f Icat  Ions . Some  speci- 
fication systems  call  for  double  delta  measurements,  for  relays  sometimes  an  ultra- 
sonic foreign  particle  monitoring  procedure  Is  specified.  All  this  has  a drastic  In- 
fluence on  the  price  of  the  devices,  so  one  should  really  take  good  care  In  the  defini- 
tion or  selection  of  specifications. 

Table  II  and  HI  show  the  tests  called  for  by  GfW,  MIL  STD  and  MSFC  85  MO  specs 
for  transistors  and  IC’s,  respectively  CO  • 


Table  III  Screening  Tests  for  Transistors  and  Diodes 

to  be  made  in  Several  Specification  Systems 


Requirements 

Specification 

System 

GfW 

JANTXV 

MSFC  85  MO 

A 

B 

C 

Lot  Identification 

X 

X 

X 

X 

X 

Internal  visual 

X 

X 

X 

X 

X 

Se. ializatton 

X 

X 

X 

High  Temp.  Storage 

48 

48 

48 

46  * 24 

Temperature  Cycling 

X 

X 

X 

X 

X 

Thermal  shock 

X 

X 

X 

Acceleration 

X 

X 

X 

X 

X 

Mechanical  shock 

X 

X 

X 

Leak  test 

X 

X 

X 

X 

X 

Burn  in 

500 

168 

168 

168 

240 

Double  drift  A 

X 

Drift  A 

X 

X 

X 

High  Temp.  Reverse 

PNP 

and 

JFET 

X 

X 

Bias 

Transistors  only 

High/Low  Temperature 

Measurements 

Sample 

Sample 

Sample 

Sample 

PDA 

V* 

5* 

10* 

- 

' Percentage  Defects 

A 1 low-dl 

Table  III! 
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Set  eem 
Several 


n<j  Tests  for  IC‘s  to  be  nade 
Specification  Systems 


In 


Requirements 

Specif  teat  ion 

System 

GfM 

CLASS  A 

MFSC 

A 

B 

c 

683 

85  MO 

Lot  identification 

X 

X 

X 

X 

X 

Internal  visual 

X 

X 

X 

X 

X 

Serialization 

X 

X 

X 

X 

High  Temp. 

48 

46 

48 

24 

24 

Temp.  Cycling 

1 0Cy 

lOCy 

lOCy 

lOCy 

lOCy 

Thermal  shock 

X 

X 

X 

X 

X 

Accelerat  io.i 

X 

X 

X 

X 

/ 

Mech.  shock 

X 

X 

X 

X 

X 

Leak  test 

X 

X 

X 

X 

X-RAY  INSP. 

X 

X 

X 

BURN  - In 

500 

168 

168 

2 40 

240 

Double  Drift  A 

X 

Drift  A 

X 

X 

X 

High  Temp.  Rev.  Bias 

X 

X 

X 

X 

High/Low  Temp.  Meas. 

X 

X 

X 

X 

X 

PDA  Electr. 

10% 

10% 

10% 

5% 

Other 

5% 

5% 

5% 

5% 

SEM 

X 

X 

GE  Nimbus  and  the  international  MAROTS  Specifications  for  instance  also  call  for 
SEM  inspection  of  Microwave  Transistor?. 

As  one  can  see  in  the  tables  the  specification  calls  for  rejection  of  a whole  lot 
as  the  Percentage  of  Defects  Allowed  (PDA)  is  exceeded.  This  PDA  limits  are  different 
for  particular  components,  for  transistors  they  vary  from  5-10%  whereas  resistors  have 
PDA  limits  from  3-5%.  If  exceeding  of  PDA  limits  is  considered  as  absolute  rejection 
criterion  this  can  have  dramatic  influence  on  costs  and  delivery  times.  General  Electric 
f2j  reports  that  if  the  amount  of  relects  is  within  50%  of  the  specified  PDA  then  by 
tome  retesting  and  categorization  of  defects  6%  of  the  lots  otherwise  rejected  can  still 
be  saved . 

2.3.  PART  DERATING  FACTORS 

The  part  selected  for  a specific  high  reliability  application  must  be  chosen  so 
that  it  will  not  be  operated  at  or  near  its  maximum  specified  rating.  For  reliable 
operation  the  part  his  to  be  derated.  For  individual  components  the  stress  to  be  derated 
is  different.  In  the  cade  of  semiconductors  it  mostly  is  the  power  to  keep  the  tempera- 
ture down,  whereas  in  capacitors  it  is  the  voltage  stress  on  the  dielectric  which  is 
most  critical.  In  the  case  of  relays  or  for  r.f.  transistors  which  are  operating  at  very 
high  current  densities  the  current  must  be  derated.  Table  IV  gives  some  part  derating 
factors  which  are  generally  agreed  on  [21  . For  semiconductor  devices  a maximum  junction 
temperature  of  125°C  should  not  be  exceeded. 
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Table  IV:  Part  Lwrat  inq  factor* 


Part  Type 

Parameter  to  be  derated 

Derate  to  poret* ntacjv 
ot  maximum  ratings 

DIODE 

POWER 

20-501 

TRANSISTOR 

POWER 

15-50% 

IC-Digital 

FAN -OCT 

40-80% 

IC-LINEAR 

CCRRENT 

85* 

THERMISTOR 

POWER 

50* 

CAPACITOR 

VOLTAGE 

JO-7o« 

RESISTOR 

POWER 

20-50* 

TRANSFORMER 

TEMPEPATt'RE 

25°C- JO°C 

IN DOCTOR 

TEMPERATCRE 

25°C- 10°C 

RELAY 

CONTACT  CCRRENT 

50% 

CONNECTOR 

CCRRENT 

50-701 

Fl'SE 

CCRRENT 

c 

1 

* 

2.4.  EFFECT  OF  PRECAP  VISL'AL  INSPECTION  ON  THE  RELIARILITY  OF  K":. 

For  everyone  who  has  ever  performed  failure  analysis  of  IC's  it  is  striking  how 
many  of  the  failures  (even  of  High-Rcl  devices)  can  b e traced  to  causes  which  could 
have  been  detected  by  a proper  visual  inspection. 

Failures  detectable  by  means  of  an  optical  microscope  include: 

. Oxide  defects  (Indicated  by  different  color) 

. Metalizatlon  defects  (voids,  scratches,  bridging,  corrosion) 

. Mask  misalignment 

. Cracked  dice 

. Poor  bonds  (misplaced,  bad  wire  dressing,  double  bonds) 

. Poor  die  bonds. 

Fig.  2 shows  a double  bond  on  a post  which  is  cause  for  a reject  ecause  the  tail 
might  come  off.  There  is  a strong  tendency  to  use  precap  SEM  inspection  for  the  detec- 
tion of  possible  metalizatlon  defects  ir  mission  optical  parts.  Fig.  3 shows  a metali- 
zation  discontinuity  at  a window  in  the  oxide  which  can  only  be  detected  in  a SEM.  Speci- 
fications for  SEM  inspection  are  available  [ij  . It  has  been  shown  [*J  that  even  after 
the  manufacturer's  precap  visual  inspection  as  much  as  3,7%  of  IC's  have  still  had  to  be 
rejected  by  a customer  inspector.  This  stresses  the  need  for  visual  inspection  of  criti- 
cal parts  and  also  the  presence  of  an  inspector  at  the  manufacturer  at  the  time  the 
parts  are  manufactured. 

2.5.  SCREENING  OF  COMPONENTS 

The  basic  philosophy  of  screening  Is  that  potential  failures  are  detected  by  means 
of  testing.  Testing  may  include  the  application  of  certain  stresses  which  will  cause 
weak  devices  to  fall,  but  will  not  weaxen  good  units.  The  amount  of  stress  applied  and 
the  kind  of  tests  performed  during  screening  has  to  be  determined  for  each  specific 
part.  For  different  technologies  different  stress  must  be  used.  For  plastic  devices 
other  tests  have  to  be  used  than  for  hermetic  ones  and  for  ceramic  packages  some  stresses 
cannot  be  used  that  are  good  for  metal  case. 

The  major  causes  of  failures  in  IC's  are  given  in  Table  V for  bipolar  and  MOS 
IC's,  respectively.  It  is  also  Indicated  in  the  table  by  which  screen  this  failure 


mechanism  can  be  detected.  The  statistics  ate  from  two  sources  [ 3 bipolarj  and  ft  MCSj 
^-d  some  of  the  failutes  in  one  source  are  nt  • distinguished  ir.  the  other.  But  it  can 
be  clearly  seen  that  surface  problems  and  electrical  overstress  prevail  ir.  the  MOS 
technology  and  so  specific  screens  for  this  failure  mechanism  have  to  be  used. 

Table  V;  Statistics  of  Major  Causes  of  ('allure 


Type  of  Failure 

j Percentage  in 

Screen  used  for  determination 

bipolar  technology 

MOS  technology 

of  weak  IC 

Wire  bond 

31» 

5* 

Vibration,  mechanical  shoe*, 

thermal  cycling 

Metal l rat  ion 

26* 

23* 

Thermal  cycling,  measurements 

at  1 temperature. 

prreui  SEN  inspection 

Photo! ithography 

16* 

not  dist  1 1'"-;  : .V  . 1 

1 ,s  visual 

Surface  problems 

7* 

1? 

Power  or  high  Temperature 

Rev.  Bias  (HTRB)  burn-in 

Package  defects 

10* 

8* 

Visual  inspection,  leak  tests 

Parameterdr i f t 

not  distinguished 

7,  6* 

Burn- in  either  power  or  HTRB 

Electrical 

“ 

10% 

Test  of  input  prottccion 

overstress 

circuit  on  sample  basis 

Miscel laneous 

6 * 

8,1* 

The  cost  of  screening  is  given  in  an  RAC  publication  [ 3]  . For  MIL  Std  B83  ( *■ s A 

devices  the  bids  for  the  whole  spectrum  of  tests  ranged  from  32.60  to  37.90.  For 
Class  B devices  it  ranged  from  31.36  to  34.75. 

Especially  important  during  the  screening  of  components  is  parameter  drift.  The 
established  limits  of  parameter  drift  drastically  influence  reliability  but  also  the 
cost  of  parts.  Typical  values  for  the  maximum  allowable  parameter  drift  published  by 
GE  [ 2j  are  given  in  Table  VI. 

Table  VI:  Maximum  Allowable  Parameter  Frift 


Part  Type 

Parameter 

Maximum  Allowable  Drift 
from  the  initial  value 

Transistors 

Gain  <HFE> 

+ 20% 

leakage  ICB0 

+100%  or  1 OyUA 

whichever  is  greater 

FET*  s 

Transconductance 

+ 20% 

Signal  Diodes 

Leakage  IR 

+100%  or  lO^uA 

forwar  1 voltage  VR 

+ 10% 

Zener  Diodes 

Leakage  IR 

+100%  or  50/UA 

breakdown  voltage 

+2%  of  initial 

Digital  IC  (TTL) 

V0H 

+ 10% 

►4 

O 

> 

+ 20% 

JIL 

+ 10% 

IIH 

+10%  or  4^uA 

Film  Resistors 

Resistance 

+0,2%  + 0,01 

Wirewound  Resistors 

Resistance 

+0,2%  + 0,05 

Capacitors 

Capacitance 

Ceramic 

+ 10% 

Glass 

+ 2% 

Plastic- 

+ 5 i 

Thermistors 

Zero  Power  Resistance 

+ 1% 

J.h.  INCOMING  INSPECTION  AND  SCREENING  BY  THE  USER 


That  even  after  all  the  scrtemng  performed  by  the  manufacturer  of  a component 
an  incoming  inspection  by  the  user  is  necessary  has  been  often  stressed.  Ke  have  once 
had  the  case  of  a space  qualified  component  stamped  as  a digital  1C  which  actually  had  a 
linear  device  inside  the  package.  Recently  published  data  also  indicate  this  need. 

Table  VII  shows  the  information  that  Goddard  Space  Flight  Center  has  published  [ 5j, 
indicating  that  after  incoming  inspection  and  additional  screening  even  for  JANTX 
transistors  the  rejection  rates  were  as  high  as  20%. 

Table  VII:  Incoming  Inspection  and  Sr  i ening  Rejection  Rates 

Type  of  transistor  | Scr  iing  Test  Rejection  Rates  in  % 

JaNTX  20.1 

114.4 

61.8 

So  for  mission  critical  parts  (and  preferably  for  all  others  too)  there  should 
be  an  Incoming  inspection  and  as  the  Goddard  report  has  shown  also  some  limited  amount 
of  additional  screening. 

2.7.  USE  OF  PLASTIC  IC's 

There  has  been  a lot  of  discussion  on  the  use  of  plastic  IC’s  for  Hi-Rel  applica- 
tions [ 6 ] . A new  development  by  RCA  shows  good  promise  of  overcoming  the  major  problem 
encountered  In  all  plastic  IC's  namely  that  of  hermeticity  (see  fig.  4).  A passivation 
layer  of  silicon  nitride  is  used  to  protect  the  silicon  surface.  The  junctions  are 
contacted  by  means  of  a platinum-si 1 lclde  contact.  Then  a three  metalization  consisting 
of  Ti-Pt-Au  is  used  with  T1  used  for  good  adherence,  Pt  as  a diffusion  barrier  be- 
tween the  gold  and  the  titanium  and  Au  for  good  conductivity.  On  top  of  the  metalization 
there  is  another  passivation  layer  consisting  of  phosphosilicate  glass.  Fig.  5 
shows  the  Weibull  Probability  Chart  for  standard  Motorola  C-MOS  plastic  devices  [ 7]  . 
After  a little  more  than  2-103  hours  504  of  the  devices  have  failed  in  85°C/85%  R.H. 
environment  with  a bias  of  10  V.  Also  indicated  are  the  results  of  the  same  test  on 
the  RCA  TRIMETAL  Plastic  IC's  [8]  which  show  no  failure  even  after  5*103  hours  of 
operation.  But  up  to  now  only  few  types  of  IC's  are  available  in  the  new  technology. 

3.  DESIGN  OF  RELIABLE  ELECTRONIC  CIRCUITS 

3.1.  HANDLING  OF  INTEGRATED  CIRCUTS  AND  STATIC  OVERVOLTAGE  PROTECTION 

In  failure  analysis  statistics  it  has  been  determined  that  the  failures  due  to 
mishandling  of  the  devices  is  in  the  range  of  10%  [4]  . Especially  sensitive  to  mis- 
handling are  MOS  IC's  but  also  bipolar  linear  IC's  (especially  with  high  input  impe- 
dances or  circuits  with  low  output  impedances  are  in  danger  f 9 3 . Besides  overstressing 
by  exceeding  the  rated  values  during  tests  and  in  operation,  the  device  might  be  in- 
serted in  a wrong  way.  Most  frequent  however  are  defects  by  excessive  static  voltage 
at  the  input  of  MOS  devices  with  Insufficient  protection.  Fig.  6 shows  a typical  input 
protection  circuit  for  C-MOS  devices.  Fig.  7 shows  the  implementation  on  an  IC. 

Table  VIII  shows  GSFC  results  of  failure  analysis  on  C-MOS  devices  [10]  . The 
failure  mode  of  44  % of  the  total  amount  of  failed  devices  was  electrical  overstress. 


Table  VIII:  OSFC  Results  of  Failure  Analysis  of  C-MOS 


tEg 


v' 


Failure  Mode  | Number  Failed  | Percent  Failures 

electrical  overstress 
contamination 
gate  oxide  defect 
not  defective 
open  or  discontinuous 

metaliraticn  oxide  steps 
"radiation  damage 
not  determined 
mislabeled 
hole  in  field  oxide 
smeared  or  scratched  metalizaticn 
defective  bonds 
cracks  in  die 
mechanical  overstress 

"purposely  exposed  to  radiation 

For  High  Reliability  applications  certain  handling  precautions  must  be  taken: 

- MOS  devices  and  high  impedance  linears  should  be  shipped 
with  leads  shortened 

- The  surfaces  of  working  benches,  chairs  and  handling 
equipment  as  well  as  the  operator  should  be  grounded 

- Control  humidity  to  no  less  than  50  t R.H. 

- Clothing  should  resist  static  charge  build-up 

- Avoid  power  transients  (no  insertion  or  removal  of 
circuits  with  power  on) 

- Soldering  irons  are  to  be  grounded  and  temperature 
controlled  ones  checked  for  spikes  during  temp,  control 

- Ground  unused  inputs 

- Check  power  supplies  and  testers  whether  they  have 
a voltage  spike  as  the  mains  is  switched  off  or 
during  power  failure.  This  is  especially  important 
for  burn-in  racks  (use  crowbars  if  possible) 

Besides  the  measures  described  above  it  is  very  important  that  in  the  design 
of  circuits  care  should  be  taken  to  avoid  overstressing.  For  instance,  due  to  the 
particular  protection  circuits,  very  high  currents  can  flow  if  the  power  supply  of 
C-MOS  circuits  is  switched  off  and  a low  impedance  source  is  still  connected  to  the 
input  of  that  circuit.  In  this  event  the  high  current  will  flow  through  the  protection 
diodes  and  can  lead  to  damage  of  these.  So  whenever  this  can  happen  a resistor  limiting 
the  current  to  a safe  value  has  to  be  added.  Especially  in  multiplexers,  where 
external  sensors  are  still  connected,  this  kind  of  failure  is  quite  frequent.  Also 
additional  capacitors  after  this  limiting  resistor  are  sometimes  advisable  to  integrate 
voltage  spikes  on  long  wires  from  sensors  to  the  electronic  package  (as  frequently 
found  in  airplanes)  if  the  speed  allows  it.  Some  of  the  C-MOS  devices  oscillate  if 
inputs  are  left  open,  because  the  complementary  output  transistors  float  through 
the  active  region  of  their  characteristic.  So  unused  inputs  must  be  grounded  and  even 
the  Inputs  of  the  IC’s  on  each  printed  circuit  board  would  best  be  grounded  by  a high 
impedance  resistor  because  during  servicing  the  previous  card  might  be  removed  and  the 
inputs  would  be  floating. 
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:.i.  i k!:y;«"T!v>m;  fop  •*»•»  hat i os  o»  intl-ikatel  .•ir.tit 

M.st  ♦ :.«•  :.i  !(-.  I'ain  .Sr  iv,  rs  is.  !<•:..  bipolar  ar.d  also  Xus  irchnclogu-s,  arc 

short  Oir.'-It-J  I«  : . Yus-  -.u:.  *.  bi  • am  r.  t.  • M.  i-x.vi-d  the  SieClfled  vj1.cs. 
ill.  B shows  a Bi't  jIumi  kt.  t.ui  a*.  as  a !.sv  )ai  :i.'«  -I  t oi  .".act.  vjrrvr.t  in  a C-MOS 

icvi.v.  r.’.roi  .twicis  won  c.T.nvct  >.i  ;r.  parallel  and  when  r rjr.sistor  netai irat ion 

.[<■:. is!  ,i(  the  other  t W met  ai : rat  ;o:.s  alu-  :_r:.«U  .at.  In  '-Veo  and  TTI-  integrated 
v.t.’aits  vattc.t  s;  '.•.mi  v.-.rs  which  oar.  rijo1.  high  lev«  Is  of  car  resit . lurir.q 

uwno.Mr..!  u’jivs.  states  t .*.t* r e is  a period  where  1st:,  transistors  connected  ir.  series 
across  t he  (ower  s a;  j 1 y an  J-ct . r.-i . i _r  the  case  v!  '-VeS  circuits  tt.ls  is  st.O'wn 
ii.  i id.  s,  which  .jives  t:.i-  current  drain  ct  a .".4'X  ’ Je[e:idi:.g  or.  t:.e  input  voltaic, 
r.r  a Safily  velt  j le,  wmo:.  is  Liqger  tt.ar.  the  sar  ai  the  threshold  vcltaies  of  tne 
t w.  transistors,  v.ere  is  oor.s  ldoraL  H-  current  acr.ss  t!.e  transistors.  Therefore  tt.e 
power  supply  volta-ie  should  l.e  properly  chosen  sac:,  as  not  to  exceed  critical  current 
levels,  Fig.  Id  sf;ows  t :.e  dependence  ot  t:.»  | ewer  dissipation  .!  C-MOS  circuits  on  the 
rise  and  fall  tine  of  the  input  pulses  ar.d  the  supply  voltage  for  a fixed  pulse  re- 
petition rate  of  too  Kc.  I*  can  be  seer,  that  above  a certain  value  of  rise  time  the 
power  dissipation  increases  quite  strongly.  This  increase  in  power  dissipation  has  to 
be  taken  into  account  if,  due  to  agino  or  radiation  damage,  the  threshold  voltages 
and  therefore  the  switching  tines  increase. 

Another  problem  encountered  in  IC's  . ■?  th  »“  of  PNPN  latch-up.  It  has  been  reported 
fllj  that  a number  of  C-MGS  circuits  of  the  CDluv  >,  CC4CVJ  type  had  been  destroyed  by 
PNPS  latch-up.  Every  10  with  an  isolation  diffusion  shows  a PNPN  structure  and  if  the 
number  of  current  carriers  in  the  IC  is  high  enough,  then  the  device  will  latch  on 
like  an  SCR.  Due  to  the  lack  of  current  limiting  resistors  this  will  lead  to  the 
destruction  of  the  device.  So  care  must  be  taken  to  avoid  too  high  output  currents. 

No  PNPN  latch-up  occurs  for  the  CD4009/10  if  t'DD <10  V and  CLwT200  pF. 

3.3.  SELECTION  OF  PROPER  SUPPLY  VOLTAGE 

In  most  technologies  the  supply  voltage  to  be  used  is  fixed.  In  technologies  such 
as  MOS  and  C-MOS  however,  the  supply  voltage  can  in  some  instances  be  chosen  over  a 
very  wide  range  of  3 V to  18  V.  The  supply  voltage  first  Influences  the  speed  of 
operation.  Fig.  11  shows  the  dependence  of  the  rise  and  fall  times  of  the  output 
pulses  on  the  supply  voltage  for  the  IC  CD40O1  for  a capacitive  load  of  C,  =»  50  pF. 

The  output  impedance  also  depends  on  the  supply  voltage  as  shown  in  Fig.  12.  The 
AC  and  DC  impedance  decrease  with  increasing  supply  voltane.  As  lateron  shown,  the 
noise  immunity  also  increases  with  the  supply  voltage.  It  would  therefore  seem  that 
it  is  best  to  operate  near  the  maximum  specified  voltage.  There  are  some  drawbacks 
however.  First  as  already  described  above  (see  Fig.  10)  the  power  dissipation  in- 
creases with  the  supply  voltage. 

A much  more  important  problem  is  however  illustrated  in  Table  XX  which  is  based 
on  the  results  of  Motorola  [l2j  and  SSS  £l3}  voltage  stress  lifetime  tests  at  several 
supply  voltages.  It  is  seen  that  Motorola  unit-  show  a failure  rate  at  18  V,  which 
Is  higher  by  a factor  of  16  than  that  at  10  V.  The  factor  is  still  13  between  operation 
at  10  V and  15  V.  Similar  measurements  by  SSS  show  a failure  rate  which  at  15  V is 
three  times  higher  than  that  at  10  V.  Therefore,  in  order  to  keep  the  failure  rate  low, 
a compromise  between  Increase  of  speed  and  the  need  for  reliability  has  to  be  made. 


Table  IX:  Influence  of  Voltage  Stress  on  Failure  Rate 


HM 


IW-ttl  » MKIM  itHli  m *»:-.«■  **T1 


3.4.  IMPACT  OF  MSI  AND  LSI  ON  SYSTEM  RELIABILITY 

The  failure  rate  for  SSI  and  MSI  circuits  is  basically  the  same  and  so  because 
of  the  much  higher  number  of  equivalent  gate  functions,  the  failure  rate  per  gate  is 
lower.  Table  X illustrates  this  for  a typical  case. 

Table  X:  Respective  Approximate  Failure  Rates  of  SSI  and  MSI 


failure  rate  / IC 

Complexity 

failure  rate/gate 

at  55  °C  in  » / 1000  h 

number  of  equiv.  gate  function 

at  55  °C  in  » / 1000  h 

SSI 

0,010 

5 

0,002 

MSI 

0,015 

50 

0,0003 

Ratio  7 


So  either  the  same  problem  can  be  solved  more  reliably  or  considerably  more  complex 
problems  can  be  solved  at  the  same  reliability. 

With  the  availability  of  single  chip  LSI  microprocessors  a new  era  of  circuit  design 
has  arrived.  It  is  no  longer  necessary  to  implement  different  circuits  for  control, 
computation  or  experiments  in  always  changing  hardware  designs.  Using  a microprocessor 
it  is  only  necessary  to  change  the  software  and  use  different  read-only-memories  and 
perhaps  some  additional  analog-to-digital  or  digital-to-analog  converters.  With  the 
possible  use  of  the  same  circuit  for  different  applications  this  minimizes  the  amount 
of  different  parts  and  thus  increases  the  reliability.  Besides  the  experience  with 
previous  designs,  using  the  very  same  IC  can  be  fully  utilized.  In  addition  the  high 
complexity  LSI  circuit  of  course  has  an  even  lower  failure  rate/gate. 

3.5.  SYNCHRONOUS  OPERATION 

Almost  all  asynchronous  pro'  lems  can  be  solved  by  synchronous  operation  too. 

First  synchronous  circuits  are  much  easier  to  test  and  service  because  one  has  a 
continuous  clock  which  can  be  used  to  trigger  oscilloscapes  etc.  If,  for  instance,  one 
has  to  control  the  sequence  of  some  operations  a chain  of  univibrators  can  be  used  as 
shown  in  Fig.  13.  Each  univibrator  in  turn  triggers  the  next  one  and  so  each  of  these 
adds  to  the  possible  error  in  timing.  Besides  this  approach  can  be  very  expensive  and 
uses  more  components  for  complex  applications. 
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Fig.  i4  shows  the  synchronous  solution  cf  the  sane  protlea.  In  this  case  the 
accuracy  of  the  circuit  is  only  determined  by  the  clock  generator  which  can  be  crystal 
controlled.  The  parts  count  is  less  for  complex  problems  ar.d  sc  of  course  the  reliability 
also  goes  up.  And  as  already  mentioned  testing  and  servicing  is  quite  simpler  too. 

There  are  a lot  of  examples  where  synchronous  operation  offers  great  advantages  as  far 
as  the  reliability  of  t he  circuits  is  concerned 
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J.o.  NO!  SI.  IMMUNITY  1 


If  relial  ie  operation  at  nigh  noise  levels  is  necessary,  one  would  use  the  slowest 
possible  luiic  family  or  on*  of  the  mgr:  hist  immunity  logic  families  such,  as  the 
Siemens  F!IU>0  series.  However,  ever,  •if  these  specially  desur.ed  fltl  lies,  standard 
Y-MOS  compares  quite  well  ;f  t :.e  supply  vultuie  is  properly  chosen.  The  dynamic  cress 
coupling  r.uise  immunity  is  shown  m Sir.  l*  f 14,  1 Oj  for  both  the  "C"  level  >F  ig . 1 sa 
and  the  "l"  level  !' . i . ' Yb 1 . Fi:.  U-  shows  the  test  circuit.  The  noise  immunity  in- 
creases with  the  ;->fus  supply  v-  Ita  .'<■  f^r  both  states.  Sc  ir.  order  to  obtain  a high 
r.oise  immunity  t:.e  supply  vcl'aie  s.'.o-ld  be  f.igr.  again.  Below  2 n.F  cross  coupling 
capacity  t h : : i .« t . n.  ise  immunity  Kgic  is  better  as  far  as  ncise  immunity  is  concerned. 

3 . ? . i’i.l'YNL  .NYY  YLHS-  S SCREEN1NJ 

By  using  standard  components  m parallel  or  serial  redundancy  single  defective 
parts  have  no  effect  on  circuit  operation.  However,  one  lias  to  know  the  most  probable 
failure  mad-  , namely  short  circuit  or  open  or  use  quadruple  redundancy.  If  the 
most  probuL.c  case  of  failure  is  a short,  then,  for  example,  two  diodes  in  series 
could  be  used  (one  would,  still  cut  off).  If  the  most  probable  failure  is  an  open, 
then  connecting  two  diodes  in  parallel  would  be  the  solution. 

Since  in  most  of  the  cases  one  does  however  not  know  the  type  of  failure  one  would 
have  to  use  quadruple  redundancy,  namely  two  diodes  in  series  and  two  in  parallel. 

Tins  is  quite  expensive  too  and  also  very  bulky  (4  times  the  parts  count),  so  except 
for  a few  rare  cases  where  extreme  reliability  is  needed  and  where  in  addition  the 
parts  are  screened  the  redundancy  method  is  hardly  used. 

3.8.  COST  VERSES  RE!  T AB I LITY 

!f  a higher  reliability  of  systems  is  needed,  the  necessary  screened  components 
are  more  expensive  than  those  for  commercial  applications.  An  idea  of  the  additional 
prices  is  given  in  the  RAC  report  mentioned  above  T3J.  If,  however,  one  takes  into 
accoi nt  in  the  case  of  planes  the  cost  of  the  overall  system  including  service,  then 
the  seemingly  more  expensive  Hi-REL  unit  may  prove  to  be  less  costly  after  all. 

There  is  a certain  amount  of  fixed  costs  per  IC  package  which  adds  to  the  actual 
price  of  IC's  anyway.  According  to  *-his  TI  publication  £ T 6j  the  fixed  costs  for 
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amount  to  about  $1. — to  92.  — . This  fixed  price  Is  already  gulte  high  conpared  to 
present  day  prices  for  SSI  circuits.  So  because  these  costs  are  not  to  be  avoided 
anyway,  seme  additional  screening  may  not  make  the  overall  system  much  more  expensive 
at  all.  It  has  been  shown  that  an  order  of  magnitude  less  factory  line  repairs  may 
be  achieved  by  using  screened  parts  in  place  of  normal  military  types  £l7j  . Since 
the  reliability  of  the  circuits  is  increased  by  going  to  MSI  and  LSI,  both  costs  may 
be  decreased  and  reliability  increased  at  the  same  time  by  a lower  number  of  parts. 
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Fig.  7:  Implementation  of  C-MOS  input 
protection  circuit 
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Fig.  8s  Metalizatlon  turn-out 
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Fig.  9 i Current  drain  depending  on  input 
voltage  for  CD4001  C-MOS  circuit 


Fig.  lOs  Power  dissipation  versus 

rise  and  fall  times  of  input 
pu’ses  for  CD4001  C-MOS  circuit 
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Fig.  11i  Rise  and  fall  times  of  CD40C ’ as  a Fi',.  12s  Static  and  dynamic  output 

function  of  supply  voltage;  C^»  50  pF  impedance  depending  on  supply 

voltage 


f i.: . 1 i : Asynchronous  solut  »vr.  cf 

control 


fig.  15:  Nclse  Immunity  of  C-MOS  CD40O1  and  Fig.  It.:  Noise  immunity  test  circuit 

Siemens  rzlOO  for  ’0"  (a)  and  "1"  <b)  \ 
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SUMMARY 


The  use  of  1 i f e -c vc  1 o *cost /ties i g- -t o-cos t cowrltnt  nts  on  new  weapon  systems 
contracts  has  1 econo  necessary  as  a resu,t  of  the  high  cost  of  acquisition  and  ownership 
of  these  sv'tfrs.  I.i  f e -c  vc  le-cos  t analyses  are  being  performed  during  proposal,  develop- 
ment, and  production  phases  of  contracts  to  control  potential  weapon  and  avionic  system 
co.'t  problems.  The  cost  ..nalvses  use  life-cvcle  and  logl  st  ic -support  cost  models  as 
evaluation  tiols.  One  of  the  major  contributors  to  th“  life-cvcle  cost  of  a weapon  system 
is  the  operational  reliability  of  the  avionics.  The  interface  of  avionics  reliability 
with  life-cycle  cost  is  discussed  in  this  paper. 


INTRODUCTION 

The  inclusion  of  1 1 fe-c vc le-cos t /des ign-to-cost  concepts  in  .major  defense  system 
contracts  is  being  emphasised  to  provide  a cost  discip’ine  for  use  throughout  the  acquisi- 
tion and  operation  of  the  svstem.  Operational  reliability  of  electronic  equipment  is  one 
of  the  major  parameters  that  influence  life-cycle  cost.  Since  the  interface  of  reliability 
and  cost  under  these  concepts  is  rather  new,  it  Is  the  purpose  of  this  paper  to  describe: 

0 What  life-cvcle  cost  is. 

o Why  the  services  are  promoting  life-cycle  cost. 

o What  analysis  techniques  are  used  to  evaluate  life-cycle  cost. 

o What  1 i fe-cyc 1 e-cost /design-to-cost  requirements  are  contained  in  present 
contracts. 

o The  reliability  interface  with  life-cycle  cost  during  proposal,  definition, 
and  production  phases. 


LIFE-CYCLE  COST  DEfINED 


Life-cycle  cost  of  a system,  as  defined  In  Department  of  Defense  Directive  5000.28, 
is  the  total  post  to  the  Government  of  acquisition  and  ownership  of  that  system  over  its 
full  life.  Life-cycle  cost  covers  the  cost  of  development,  production,  operation,  support, 
and,  where  applicable,  disposal  (see  Figure  1). 


Development  costs  are  all  the  research  and  development  costs  associated  with  the 
weapon  system  jirior  to  production  - the  design,  the  hardware  development,  and  the  verifica- 
tion of  the  design. 


Production  costs  are  the  costs  associated  with  procuring  the  basic  unit  with  pro- 
pulsion equipment,  electronics,  armament.  Government  furnished  equipment,  and  other  weapon 
system  Items  sijch  as  peculiar  ground  support  equipment,  peculiar  training  equipment, 
technical  data,  and  initial  spares. 


Operations  and  support  costs  are  those  resources  required  to  operate  and  support  the 
system  uurlng  its  useful  life  In  the  operational  inver.ory. 


THE  NEED  FOR  LIFE-CYCLE  COST  IN  PROCUREMENT 

The  cost  of  procurement  and  operation  of  a weapon  system  has  increased  dramatically 
at  the  same  time  that  defense  budgets  are  being  constrained.  On  the  basis  of  historical 
trends  (Figure  2),  present  projections  into  the  future  forecast  an  even  worsening  DoD 
budget  squeeze.  If  the  cost  of  all  successor  weapon  systems  continues  to  rise,  there 


LITE  CYCLE  COST  - HOW  MUCH  WILL  BE  SPENT  ON  A PRODUCT  FROM  THE  DAY 
Of  PURCHASE  UNTIL  THE  DAY  OF  DISPOSAL 
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Figure  1 WHAT  IS  INCLUDED  IN  LIFE  CYCLE  COST  T 


simply  will  not  be  enough  money  to  fulfill 
the  requirements  of  these  future  programs. 
The  services  must  obtain  tools  whereby  they 
can  estimate  how  much  a weapon  system  Is 
going  to  cost  so  that  unaffordable  systems 
can  be  rejected.  In  the  present  cost* 
squeeze  environment,  the  services  can  pro* 
cur*  weapon  systems  only  if  they  know  the 
cost  * not  only  of  the  initial  purchase,  but 
alto  of  the  cost  of  owning  the  system. 

Department  of  Defense  Directive 
5000.28,  dated  May  1975,  establishes  policy 
and  guidance  In  the  application  of  deslgn- 
to-coat  principles  to  the  acquisition  of 
defense  systems,  subsystems,  and  components. 
The  deslgn-to-cost  concept  contained  In  the 
directive  states  that  the  following  will  be 
accomplished : 
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Figure  2 PERCENT  OF  FEDERAL  EXPENDITURES 
ALL0TED  TO  DEFENSE 


o Life  cycle  cost  objectives  shall  be  established  for  each  acquisition  and 
separated  Into  cost  elements  within  the  broad  categories  of  development, 
production,  operation,  and  support.  As  system  definition  continues,  the 
cost  elements  are  firmed  into  cost  goals  to  which  the  system  will  be  designed 
and  Its  cost  controlled. 

o During  design  and  development,  cost  requirements  and  the  achievement  of  cost 
goals  will  be  evaluated  with  the  same  rigor  as  technical  requirements  and  the 
achievement  of  performance  goals.  Practical  tradeoffs  between  system  capa- 
bility, erst  and  schedules  must  be  continually  examined  to  Insure  that  the 
system  developed  will  have  the  lowest  llfc-cycle  cost  consistent  with  schedule 
and  performance  requirements, 

o The  cost  goals  established  and  "designed  to"  In  the  development  phase  will  be 
extended  Into  subsequent  phases  of  the  system’s  life  cycle.  Production  cost 
will  be  rigorously  controlled  to  the  production  goals. 


')  1 

o A1;  t hi-  sv'tcm  is  Introduced,  operation  and  support  cost  goals  will  he  utilised 
to  control  initial  outfitting  cost,  personnel,  span's,  rework,  etc  In  the 
operational  feedback  process,  change  requests  generated  by  operational  usage 
and  teedhack  design  engineering  will  reflect  the  use  of  design-to-cost  principles 
and  tradeoffs  necessary  to  insure  the  lowest  cost  Is  obtained  to  achieve 
acceptable  performance 


I.  IKK  -CYC  t.K -COST  ANALYSIS  TECHNIQUES 

Since  the  services  are  requiring  that  llfe-cvcle  cost  be  given  equal  consideration 
along  with  performance  and  schedule,  both  Government  organizations  ard  industry  are  obli- 
gated to  create  techniques  and  methodologies  for  use  in  quantitative  evaluation  and  control 
of  this  cost  during  definition,  design,  development,  production,  and  operational  usage  of 
a weapon  svstem.  A technique  that  Is  being  developed  presently  Is  that  of  evaluation  of 
llfe-cvcle  cost  hv  use  of  analytical  models. 
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Figure  3 WEAPON  SYSTEM  LIFE  CYCLE  COST  MODEL 


The  analytical  model  of  a weapon  system  life-cycle  cost  can  be  described  as  a set 
of  mathematical  equations  whose  solution  represents  a close  approximation  of  the  true 
life-cycle  cost  for  that  system  (Figure  3).  Thus,  the  task  of  model  development  in  this 
case  is  one  of  deriving  a set  of  equations  which  are  a function  of  those  parameters  that 
influence  the  life-cycle  cost  of  the  weapon  system,  (One  of  the  major  parameters  that 
drives  the  life-cycle  cost  model  Is  the  operational  reliability  of  equipment.)  Such  a 
model  can  serve  as  a tool  to  evaluate  and  control  costs  at  the  weapon  system  level  by: 

Maintaining  up-to-date  estimates  of  weapon  system  cost  during  all  phases 
of  the  program. 

Determining  individual  equipment  and  function  cost  goals. 

Evaluating  impacts  of  proposed  design  operational  or  reliability  improvement 
change  on  life-cycle  cost. 

Identifying  equipment  and  function  cost  problem  areas  and  determining 
impact  on  weapon  system  life-cycle  cost. 
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o Providing  life-cycle  co*t  data  t'or  design,  tradeoff  and  reliability 
Improvement  studies. 

Life-cycle  cost  can  be  expressed  mathematically  in  terms  of  all  functions  that 
generate  cost  (Figure  4).  Because  the  cost  of  any  one  function  adds  to  the  total  cost, 
the  life-cycle  cost  equation  (In  Its  most  general  form)  consists  of  the  sum  of  all  cost 
generators.  Even  though  the  weapon  system  equation  is  simply  the  sum  of  all  costs,  the 
cost  expressions  of  the  lower  tier  functions  can  take  various  forms  as  shown  In  Figure  4. 


WtAPON  SYSTEMS  m COST  OF  ALL  FUNCTIONS 

LIFE  CYCLE  COST  I LCC  - 1 C,  # FROM  DAY  OF  PURCHASE 

\ z \ TO  DAY  OF  DISPOSAL 


Figure  4 WEAPON  SYSTEM  LIFE  CYCLE  COST  MODEL  EOLATIONS 


Other  models  for  Items  below  the  weapons  system  level  can  be  used  to  obtain  certain 
aspects  of  life-cycle  cost.  One  of  these  Is  the  ORM  (Optimum  Repair  Level  Analysis), 
whose  primary  objective  Is  to  determine  the  recommended  repair  level  of  an  Item  (any  shop 
replaceable  unit  or  repairable  part).  This  objective  Is  reached  primarily  as  a result  of 
economic  decisions  made  in  the  analysis  portion  of  the  model.  Item  data  (Item  spare  cost, 
repair  manhours,  parts,  cost  and  failure  frequency,  support  equipment  costs,  training  re- 
quirements, data  requirements,  non-economic  factors,  and  operational  data)  are  Input  to 
the  model.  Repair  ’evel  costs  for  dlscarded-at-fal lure , base  repair,  and  depot  repair  are 
calculated  and  compared  so  that  a recommended  repair  level  and  alternatives  can  be  obtained. 
A parametric  sensitivity  analysis  is  also  performed  for  use  as  a design  tradeoff  aid.  The 
optimum  repair  level  output  allows  the  determination  of  logistic  support  costs  and  sparing 
requirements,  which  are  significant  portions  of  the  item  life-cycle  cost. 


LIFE-CYCLE  COST  IN  PRESENT  CONTRACTS 

Because  specific  contract  provisions  for  life-cycle  cost  should  be  tailored  to  the 
weapon  systems  or  equipment  being  procured,  a standard  set  of  specific  contract  terms  and 
conditions  do  not  exist.  However,  one  can  review  the  design-to-cost/life-cycle-cost 
(DTC/LCC)  sections  of  the  F-16  contract  as  an  example  of  what  is  being  Included  In  present- 
day  aircraft  contracts.  The  F-16  contract  includes  11  fe-cycle-cost  related  com.,  laments 
associated  with 

o Dcslgn-to-Cost 

o Air  Vehicle  and  Support  Cost  Reduction  Trade  Studies 


o Logistic  Support  Cost 

o Reliability  Improvement  Warranties 

F-16  DF.S  IGN-TO-COST  COMMITMENT 

The  current  contract  for  full-scale  development  of  the  F-16  contains  a section 
specifically  for  design-to-cost.  The  salient  Items  of  the  section  are  surmarized  below: 

o Definition:  Unit  production  flyaway  costs  are  defined  as  the  recurring  and 

non-recurring  costs  (excluding  all  development  costs)  necessary  to  produce  a 
complete  aircraft.  These  costs  Include  costs  of  airframe,  nropulsion, 
electronics,  armament,  other  CFAE/urL,  engineering  change  orders  of  a 
recurring  nature,  and  non-recurring  production  costs. 

o A prime  objective  of  the  development  phase  is  to  design  to  a cumulative  average 
unit  production  flyaway  cost  of  $3,842,525  expressed  In  FY  1925  dollars  for 
1000  production  aircraft,  at  a maximum  production  .ate  of  15  aircraft  per  month. 

o The  contractor  shall  control  and  track  his  portion  of  the  des 1 gn-to-uni t - 

production  flyaway  cost  of  $2, 323,074  throughout  the  development  cycle.  This 
figure  excludes  engine,  radar,  and  Government  furnished  equipment. 

o The  contractor  is  also  expected  to  include  as  a management  objective  during 
development  the  control  of  future  downstream  operating  and  support  costs.  The 
Government  will  entertain  requests  for  adjusting  the  deslgn-to-c JSt  goal  at  anv 
time  during  the  contract  for  real  or  demonstratable  costs  of  ownership  savings 
which  would  result  In  an  overall  life-cycle-cost  benefit  to  the  Government. 

o Two  design-to-cost  demonstration  milestones  are  included  in  the  contract  with 
achievement  dates  of  19  months  and  25  months  after  contract  award.  The 
objective  of  each  milestone  is  to  demonstrate  the  extent  to  which  the  contrac- 
tor's portion  of  the  flyaway  cost  sill  meet  the  goal  of  $2,323,074. 


AIR  VFHICLE  AND  SUPPORT  COST  REDUCTION  TRADE  STUDIES 

Two  separate  sets  of  li fe-cyc le-cost /design-to-cost  design  trade  studies  are  to  be 
performed  by  the  contractor  - one  on  the  air  vehicle  and  the  other  on  supportabl llty.  The 
detailed  definition  of  these  trade  studies  is  included  in  the  contract.  Award  fees  can  be 
payable  to  the  contractor  by  the  Government  in  connection  with  these  trade  studies.  The 
award  fee  will  be  based  on  an  evaluation  of  the  completion  of  these  trade  studies  and  the 
use  of  the  results  in  the  design  of  the  air  vehicle  and  support  equipment. 


LOGISTIC  SUPPORT  COST  COMMITMENT 

The  contract  contains  two  types  of  logistic  support  cost  commitments  - one  on 
selected  electronic  equipment  and  one  on  the  total  aircraft  minus  the  selected  electronic 
equipment  and  minus  the  engine.  The  two  commitments  are  called  Target  Logistic  Supp-rt 
Cost-Correction  of  Deficiencies  (TLSC-COD),  and  Target  Logistic  Support  Cort-System 
(TLSC -SYSTEM) , respectively.  These  commitments  are  summarized  In  the  following  paragraphs. 


TLSC-COD  Commitment 

The  contractor  guarantees  that  the  total  Measured  Logistic  Support  Cost  (M1.SC-C0D) 
will  not  exceed  a specified  total  Target  Logistic  Support  Cost  (TLSC-COD)  for  selec  ’d 
electronic  First  Line  Units  (FLUs)  when  the  measured  values  are  obta  led  (by  a test  pro- 
gram described  below).  The  FLUs  that  are  included  in  the  TLSC-COD  . » shown  in  Figure  5. 

The  TLSC-COD  value  (one  value  for  the  total  mmber  of  FLUs)  was  computed  by  tne 
Air  Force  during  the  proposal  phase  on  the  basis  of  the  contractor's  estimates  of  Fl.'J 
parameters  such  as  mean-f 1 i ght -t lme-betweeu  failure,  base  repair  manhours,  depot  repair 
manhours,  manhours  expended  for  preparation  and  access,  etc.  The  TUSC  value  was  computed 
by  Inputing  these  parameters  Into  the  following  abbreviated  Air  Force  equation: 


TLSC-COD 
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where 


Cj  - Initial  and  replacement  spare  costs 

Cj  “ on-equipment  maintenance  cost* 

Cj  “ off-equlpment  maintenance  ro«ts 

Cj  ” support  equipment  cost* 

n • FLU  type*  selected  for  tnctu*lon  In  TLSC-COD. 

The  detailed  formula  for  each  "C"  portion  of  the  equation  i*  Included  In  the  contract. 
The  contractor's  estimates  for  all  parameters  used  are  also  contained  In  the  contract. 
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Figure  5 FLUs  TNCLUDFO  IN  TLSC-COD 


For  purposes  of  determining  the  extent  “o  which  the  TLSC-COD  commitments  have  been 
realized,  the  Air  Force  will  conduct  a verification  test  to  demonstrate  operational  suit- 
ability. The  operational  test  will  be  conducted  at  a single  base  location  no  earliet  than 
six  months  after  full  activation  of  the  first  operational  squadron.  The  Air  Force  will  be 
responsible  for  organi zat i ona l - , Intermediate-,  and  depot-level  maintenance  and  will 
supply  support  for  the  selected  Fi.l's  Support  assets  will  be  acquired  bv  the  Air  Force  In 
sufficient  quantity  on  the  basis  of  the  original  estimated  equipment  characteristics  and 
the  anticipated  level  of  program  activity  during  the  test  period.  Maintenance  procedure* 
will  conform  with  those  prescribed  in  Air  Force  approved  technical  manual*.  The  test  pro- 
gram will  continue  until  3500  total  flying  nours  have  been  accumulated  in  alrpljnes  f-om 
the  squadron.  Ail  equipment  maintenance  actions  will  be  recorded  during  that  time. 

The  data  collected  on  Individual  FLl'*  will  be  used  In  the  same  logistic  support 
model  formula  to  establish  the  measured  logistics  support  cost  (Ml.SC-COD).  In  the  event 
that  the  total  Ml.SC-COD  exceeds  the  specified  TI.SC-COD  by  more  than  151,  the  contractor 
Is  required  to  Indicate  actions  to  correct  the  demonstrated  support  deficiency.  If  the 
MLSC-COD  1*  less  than  or  equal  to  TLSC-COD,  the  contractor  is  eligible  for  a separate 
award  fee. 

During  the  verification  of  Ml.SC-COD  on  selected  electronic  FIX*,  one  of  the  factors 
to  be  verified  by  measurement  Is  the  Mean-Fl Ight -Time-Between-Fil lure  (MFTBF)  of  each  FLU. 
MFTBF  is  defined  as  follows: 


MET  m y 


t ot  . i 1 reported  fly  ! pg  t I r <■  during  the  tot  period 

number  ol  t-il  lures  on  imi  h ( M1 

The  definition  of  a failure  wilt  he  consistent  with  that  used  for  eporting  and 
consolidating  under  the  AKM  t'fi-1  Maintenance  hata  Collection  System.  A failure  will  be 
considered  as  any  departure  from  the  required  performance  In  excess  of  the  allowable 
tolerance  defined  In  specifications.  A test  failure  will  be  defined  as  the  following 
"how  malfunctioned"  codes  and  "action  taken"  codes  (per  definitions  from  Vol'ime  XI, 

AIM  300-4): 

1.  Anv  tvpe  1 how  malfunctioned  code  (item  no  longer  can  meet  the  minimum 

specified  performance  requirement  due  to  Its  own  Internal  failure  pattern1 
In  combination  with  an  action  taken  code  F (Repair),  K (Ca 1 tbr^t ed -Ad ) us tment 
Required),  L (Adjust),  or  7 (Corrosion  Repair), 

’.  Anv  tvpe  1 how  mal funrt'oned  code  in  combinat ion  with  an  action  taken  code  P 
f Remove  an 4 Replace),  or  S (Remove  and  Reinstall),  provided  the  item  was  not 
found  serviceable  (B  action  taken  code)  at  the  bench  check  station. 

).  Anv  tvpe  1 how  mal  time  tinned  code  where  the  removal  of  the  FIX  was  required 

because  of  the  failure  of  associated  components  attached  or  connected  thereto. 
Action  taken  code  C.  (Repairs  and/or  Replacement  of  Minor  Parts,  Hardware  and 
Soft  good  s ) will  normally  apply. 

4.  Any  tvpe  1 how  malfunctioned  code  for  which  the  FIX'  is  subsequently  found  to 
be  serviceable  at  bench-check  or  depot  verification  and  the  erroneous  failure 
identification  is  due  to  Inadequately  described  test  procedures  or  test  equip- 
ment developed,  procured,  or  prescribed  by  the  contractor. 

5.  Any  tvpe  2 how  malfunctioned  code  of  553  (does  not  meet  specifications,  draw- 
ings, or  other  conformance  requirements)  or  602  (failed  or  damaged  due  to 
malfunction  of  associated  equipment  or  item).  A type  2 failure  Is  when  an 
item  no  longer  can  meet  the  minimum  specified  performance  requirement  due  to 
some  induced  condition  and  not  due  to  its  own  internal  failure  pattern. 

6.  A type  6 how  malfunctioned  code  of  800  (No  Defect-Component  Removed  and/or 
Reinstalled  to  Facilitate  Other  Maintenance),  where  such  procedure  is 
prescribed  by  a contractoi  -recommended  test  procedure  or  documented  technical 
order. 


TLSC-SYSTFM  Award  Fee 

The  contract  contains  a value  fir  Target  Logistic  Support  Cost-System  (TLSC-SYSTEM) . 
This  value  is  the  logistic  support  cost  ' irget  for  t^e  total  airplane  minus  the  selected 
electronic  Fl.Us  and  minus  the  engine.  Thr  value  was  computed  during  the  proposal  by  the 
« jme  methods  used  to  compute  TLSC-COD. 

During  the  3500-hour  test  on  the  first  F-16  squadron,  data  will  be  gathered  for 
verification  of  the  TLSC-SYSTEM.  In  the  event  the  total  MLSC -SYSTEM  Is  less  than  the 
TLSC-SYSTEM  the  contractor  is  eligible  for  an  award  fee. 


RELIABILITY  IMPROVEMENT  WARRANTY  (RIW) 

The  contractor  agrees  to  provide  (at  firm  fixed  prices)  either  of  the  two  options 
described  below: 

o A 48-month  (or  300,000-flight  hour)  reliability  improvement  warranty  on  any  or 
all  of  the  First  Line  Units  (FLL's)  listed  in  Figure  5.  (These  are  the  same 
FLUs  covered  under  TLSC-COD.) 

o A 48-month  (or  300,000-flight  hour)  reliability  Improvement  warranty  with  ffTBF 
guarantee  on  any  or  all  of  the  FLUs  listed  in  Figure  5. 

Any  of  these  options  can  be  exercised  on  or  before  production  go-ahead  and  before  spares 
provisioning.  In  the  event  that  the  Air  Force  elects  to  exercise  the  RIW  options  on  any 
FLU,  the  total  TLSC-COD  for  all  FLUs  will  be  reduced  by  an  amount  equal  to  the  associated 
logistic  support  of  each  FLU  placed  under  RIW.  Full  discussion  of  the  RIW  Is  contained 
In  an  earlier  paper  In  this  volume. 
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UV.IMIC  ;".Tr>'RT  COST-RtW  COMMITMENT  Sl'JtWRY 

The  logistic  support  cost  co-rrltment  contained  In  'e  contract  is  in  terms  of 
logistic  suppo.t  t 'St  targets  for  the  system  and  for  the  critical  electronic  fi.l's 
'future  h).  If  these  targets  are  met  the  contractor  qualifies  for  award  fee.  tf  the 
target  for  the  critical  electronics  is  not  net  the  contractor  can  Incur  a correction  of 
deficiencies.  The  RIW  clause  provides  as  an  option  cancellation  of  the  logistic  support 
c st  comr.itnent  of  anv  or  all  of  the  Fid's  and  replaces  coverage  of  these  selected  Fid's  by 
either  a repair  warranty  (RIW1  or  a repair  warrants  with  MTRF  guarantee. 
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Figure  6 LOGISTIC  SUPPORT  COST  - RIW  COMMITMENT  SUMMARY 


INTERFACE  OF  RELIABILITY  WITH  LIFE-CYCLE  COST 

Hardware  failure  frequency  Is  one  of  the  major  elements  that  drives  up  the  life- 
cycle cost  of  a weapon  system.  The  failure  rate  of  the  hardware  Impacts  corrective 
maintenance  costs,  base  and  depot  support  and  t st  costs.  Initial  provisioning  costs, 
reprocurement  costs,  transportation  and  packaging  costs,  and  maintenance  training  costs. 
Any  type  of  l 1 fe-cyc le-cost  evaluation,  tracking,  and  control  must  of  necessity  Involve 
evaluation  tracking  and  control  of  reliability.  Any  type  of  11 fe-cycle-cost  analysis  must 
Include  reliability  as  one  of  Its  major  inputs.  As  the  services  promote  the  use  of  new 
concepts  In  the  araa  of  life-cycle-cost  procurement,  new  concepts  In  the  area  of  relia- 
bility control  will  follow.  A good  example  is  the  Inclusion  of  reliability  Improvement 
warranties  as  a major  ll fe-cyc le-cost  reduction  commitment. 


1 RELIABILITY  INPUTS  INTO  LITE-CYCLE  COST  DURINC  PROPOSALS 

During  the  proposal  ph.’se,  reliability  analyses  are  performed  to  determine  the 
reliability  characteristics  of  the  various  design  configurations  being  evaluated  prior  to 
submittal  of  the  recommended  configuration  with  the  proposal.  Mission  and  hardware  reli- 
ability predictions  are  accomplished  at  the  system,  subsystem,  and  lower  levels.  These 
predictions  serve  as  Inputs  Into  reliability  requirements  analyses,  design  and  technical 
trade  studies,  and  life-cycle  and  logistic  cost  determinations. 

The  life-cycle-cost  related  effort  by  contractors  during  the  proposal  phase  is  a 
direct  function  of  what  Is  Included  In  the  contract.  Over  the  last  several  years,  nwjor 
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emphasis  has  bprn  placed  on  now  concept*  of  procurement  through  de*  1 gn-t o-cos t / 1 t f e-c  yc  le 
cost.  Contractors  are  responding.  A good  example  of  this  response  is  the  F-*6  contract, 
which  is  the  result  o*  seven  years  of  cost -reduci ng  activity,  as  shown  in  figure  7.  This 
activity  culminated  lr  the  Request  for  Proposal  (RKP>  for  what  is  now  the  F-lo. 

When  the  RFP  t ,r  full-scale  development  was  received  it  required  that  cost  data  be 
provided  to  establish  the  unit  production  flvaway  cost.  The  production  reliability  program 
costs  were  Included  in  the  establishment  of  this  cost.  Production  reliability  testing  and 
the  associated  hurn-ln  testing  of  the  avionic  equipments  were  priced  at  several  million 
dollars.  The  results  of  the  flvawav  cost  analysis  are  presented  in  Figure  8. 

The  RFP  alsc  required  that  the  logistic  support  cost  data  on  about  JOu  first  line 
units  (Fl.l’s ) be  provided.  These  Ft.l's  include  all  hardware,  from  avionic  Phi’s  to  hydraulic 
p1  imp s to  temperature  contr  units.  These  data  were  required  so  that  they  could  serve  as 
inputs  into  an  Air  Force  jpistlc  support  model.  The  model  output  results  established  the 
tap  contributors  to  tot  aircraft  logistic  cost.  A working  sheet  presenting  some  of  the 
tap  20  contributors  Is  lovn  in  Figure  9.  The  top  of  the  list  was  made  up  predominately 

of  -vior.ics  (since  the  engine  was  not  included).  The  logistic  support  cost  for  the  top 
contributors  was  established  and  put  into  the  contract  as  the  Target  I.o„istic  Cost  - 
Correction  of  Deficiencies  (TLSC-COD)  for  the  avionic  equipment  listed  in  Figure  6.  The 
purpose  of  the  TLSC-COD  was  to  place  major  contractual  emphasis  on  tnat  equipment  which 
was  projected  to  contribute  over  50',  of  Fl.U-related  logistic  support  cost. 

The  main  reason  that  the  avionic  FLL’s  -ere  top  contributors  to  the  logistic  support 
cost  was  the  high  fr«  ......  of  failure  of  these  units.  One  of  the  major  tasks  of  relia- 
bility engineers  during  tne  proposal  phase  was  to  make  estimates  of  the  caerational 
reliability  of  the  avionics  to  serve  as  inputs  into  the  logistic  support  cost  model 
Since  Tl.»C -COD  was  to  be  verified  during  Air  Force  usage  and  the  measurements  were  to  be 
based  on  information  from  the  Air  Force  AFM  66-’  Data  system,  it  was  decided  to  use  66-1 
historical  data  as  the  base  from  which  to  make  projections  on  F-16  avionics  reliability. 
Predictions  based  on  66-1  data  , ere  thought  to  be  the  most  representative  of  that  which 
will  be  experienced  in  the  field.  Historical  data  were  obtained  on  current  airplanes  such 
as  the  F-lll,  A7D,  and  the  F4E.  Extensive  studies  were  performed  by  reliability  and  design 
engineers  to  determine  the  operational  reliability  of  existing  types  of  avionics  from 
which  the  F-16  proposed  avionics  were  derived.  These  operational  reliabilities  were 
established  in  accordance  with  the  definition  of  failure  given  in  the  contract.  The  oper- 
ational reliabilities  of  the  similar  or  same-family  avionic  equipment  (baseline)  were  then 
modified  by  certain  factors  to  predict  the  reliability  of  F-16  evionic  equipments.  These 
factors  are 

o A complexity  ratio  --  baseline  equipment  to  F-16  equipment 

o Expected  technology  growth 

c Correction  of  known  problems  of  operational  hardware. 

The  RFP  also  contained  a requirement  to  commit  to  reliability  improvement  warranties 
(RIW)  with  mean-time-between-failure  (MTBF)  guarantees.  A full  discussion  on  RIW  is  con- 
tained in  another  paper  in  this  volume. 

In  summary,  the  contractual  cost  coimitnents  are  centered  about  design  to  cost, 
logistic  support  cost,  and  RIW.  A quantitative  overview  of  the  relationship  of  these 
costs  is  presented  in  Figure  10. 


RELIABILITY  IN2UTS  INTO  LIFE-CYCLE  COST  DURING  DEVELOPMENT 

During  the  development  phase,  the  important  tasks  to  be  accomplished  in  the  area  of 
life-cycle  cost  are  those  related  to  tracking  and  control.  Weapon  system  contracts  such 
as  the  F-16  have  unit  production  goals,  logistic  support  requirements,  and  potential  award 
fees  tied  to  completion  of  trade  studies.  The  successful  accomplishment  of  these  ccxsnit- 
ments  requires  full  management  attention.  Cost  tracking  procedures  such  as  shown  in 
Figure  11  are  initiated. 

During  F-16  development,  the  unit  production  flyaway  cost  goal  of  $2,323,C7i  Is 
allocated  down  to  all  Individual  hardware  and  function  element  managers.  Each  element 
manager  is  provided  with  the  allocation  he  is  responsible  for  and  with  the  up-to-date  status 
of  predicted  cost.  Reliability  program  costs  are  inherent  in  these  cost  targets. 

Trade  studies  performed  during  develo rment  are  used  to  evaluate  opportunities  for 
cost  reduction  or  Increase  in  system  effectiveness.  A system  engineer  designated  leader 
execute.,  a budget  and  time-limited  task  for  each  study.  Study  programs  are  milestone- 
oriented  to  allow  progressive  examination  by  engineering  and  program  management.  Reliability 
engineers  input  reliability  Impacts  into  each  hardware-oriented  trade  study. 
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logistic  support  costs  arc  tracked  and  evaluated  by  use  of  the  Air  Korea  Logtstlc 
Support  Cost  Model.  Predicted  values  of  logistic  support  cost  as  compared  to  the  specified 
ft. SC  values  are  generated,  and  potential  problems  are  highlighted.  Model  analyses  aid  in 
the  evaluation  of  (1)  the  avionic  KI.Cs  having  the  greatest  cost  Impact,  (2)  trade-study 
alternates,  and  (3)  life-cycle  cost. 

Katlv  In  the  development  phase,  the  MFTUKs  that  were  used  as  Inputs  to  the  cost 
analyses  are  updated  as  the  hardware  becomes  better  defined.  During  development  flight 
testing,  as  the  weapon  system  Is  being  flown  bv  both  contractor  and  Air  Korce  personnel, 
the  contractor  has  his  first  opportunity  to  establish  sn  MITIiF  tracking  system  In  an 
environment  similar  to  Air  Korce  operations.  During  this  time  reliability  engineers  com- 
pare actual  performance  of  the  hardware  during  flight  test  with  that  Included  in  the 
logistic  support  cost  model  and  R1W  commitments  to  uncover  problem  areas  and  initiate 
corrective  action  as  required. 

Past  experience  indicates  that  engineering  change  proposals  (ECP3)  can  significantly 
increase  production  or  support  costs,  formalizing  the  cost  evaluation  and  nlacing  the 
design-to-cost / l i fe-cyc le-cost  impact  in  ea> h ECP  assures  proper  recognition  of  cost 
impacts  (figure  12),  Riliabillty  is  one  of  the  main  inputs  associated  wich  alternates 
that  significantly  change  life-cycle  cost  or  logistic  support  cost. 

Dutlng  ,he  development  phase  the  contractor  selects  subcontractors  for  maj^r  air- 
plane equipment  like  the  a>'ionl  s.  On  the  K-16,  life-cycle-cost  evaluations  were  part  of 
the  source  selection  process.  Reliability  and  design  engineers  made  a reliability  predic- 
tion on  each  major  avionic  equipment  proposed  by  a vendor.  These  predictions  served  as 
inputs  into  life-cycle-cost  evaluations,  which  were  then  used  in  the  source  selection 
process.  Extensive  contact  was  made  with  subcontractors  on  life-cycle-cost  contractual 
coimitments  (see  figure  13). 


RELIABILITY  INPUTS  INTO  LIFE -CYCLE  COST  DURING  PRODUCTION 

Reliability  involvement  in  life-cycle-cost  processes  during  the  production  phase  of 
the  F-lb  centers  mainly  in  the  areas  of  rccomplishment  of  RIW  coimitments  and  participation 
in  the  verification  of  the  logistic  support  cost  requirements.  (The  involvement  of  relia- 
bility in  RIW  during  the  production  phase  is  discussed  in  another  paper  in  this  volume.) 

The  verification  of  T1.SC-C0D  an  I TLSC-SYSTEM  on  the  F-16  is  to  be  accoroollshed  by 
the  Air  Force  with  data  accumulated  du-ing  3500  squadron  flight  hours.  The  contractor 
will  supply  representatives  during  the  verification  test  to  verify  the  authenticity  of  the 
observed  data.  Failure  data  obtained  :rom  the  test  will  be  analyzed  by  contrrctor  design 
and  reliability  engineers.  If  the  tot.il  MLSC-COD  on  the  avionic  FLUs  exceeds  the  prescribed 
range  in  the  contract,  the  contractor  will  Investigate  and  formulate  a corrective  action 
plan  which,  when  implemented,  will  bring  logistic  cost  within  the  prescribed  range.  If 
the  cause  of  failure  to  meet  requirements  is  due  to  low  reliability,  the  necessary  hardware 
changes  will  be  made  to  incorporate  the  necessary  improvements. 


CONCLUSIONS 

Life-cycle-cost  provisions  in  current  weapon  system  procurement  contracts  are 
establishing  cost  as  a parameter  equal  in  Importance  with  technical  requirements  and 
schedules  throughout  the  design,  development,  production,  and  operation  of  the  system. 
Since  hardware  failure  frequency  is  one  of  the  key  parameters  that  influences  life-cycle 
cost,  any  evaluation,  tracking,  and  control  of  life-cycle  cost  must  by  necessity  Involve 
evaluation,  tracking,  and  control  of  reliability. 
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Figure  7 F-16  REFLECTS  SEVEN  YEARS  OF  MANAGEMENT  DEDICATION  TO  COST  REDUCTION 


The  fundamental  low  cost  features  of  the  F>16  have  their  basis  in  General  Dynamics' 
work  under  Air  Force  funded  FX  studies  initiated  in  1967.  In  these  studies,  many  varia- 
tions were  subjected  to  performance,  flyaway  cost,  and  life-cycle-cost  analyses.  From 
these  studies  it  was  determined  that  the  F-16  design  concept  offered  both  performance  and 
cost  advantages  over  other  approaches.  Because  of  the  potential  of  this  design  concept, 
General  Dynamics  continued  work  with  company  funds.  The  Air  Force  also  saw  the  potential 
of  this  concept  and  funded  additional  studies  in  1971.  Subsequently  General  Dynamics' 

YF-16  proposal  activities  developed  additional  cost-reducing  design  features.  After 
receipt  of  the  YF-16  contract,  General  Dynamics  instituted  a two-year  producibillty  program 
aimed  at  improved  production  management  procedures  and  production  cost  design  features. 

Both  prior  and  subsequent  to  the  flight  test  program,  support/design  studies  were  initiated 
In  summary.  General  Dynamics  management  emphasized  cost  as  a factor  coequal  with  perform- 
ance and,  by  careful  selection  of  design  features,  an  inherently  low-cost  airplane  design 
of  small  sire,  lightweight,  simplicity,  and  low-risk  technologies  was  produced. 
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•Identified  in  Proposal  • Communicated  to  WBS  Element  Managers 

FIGURE  9 T»'t.NTY  TOP  LSC  FLUs 


Logistic  support,  cost  evaluation  was  part  of  the  F-16  proposal  process.  High* 
loglstlc-support-cost  FLUs  were  made  visible.  Responsible  hardware  and  element  managers 
for  high-cost  FLUs  were  briefed  on  reasons  why  FLUs  were  expensive  (low  reliability,  high 
repair  manhours,  unit  cost,  etc.).  Top  management  was  briefed  and  Improvement  objectives 
were  formulated. 


A variety  of  contract  provisions  were  aimed  at  life-cycle  control  rather  than  a 
single  control  plan.  Contract  provisions  apply  to  specific  aspects  of  life  cycle.  TLSC 
applies  to  spares,  support  equipment,  and  repair  cost.  RIW  applies  to  repair  cost  and 
reliability  Improvement.  Dcsign-to-cost  applies  to  unit  production  flyaway  cost. 
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FIGURE  11  F-16  COST  TRACKING  AND  CONTROL 

Cost  tracking  and  control  for  design-to-cost,  logistic  support  cost,  and  life- 
cycle  cost  all  follow  the  basic  pattern  shown  above.  Costs  are  assessed  and  targets 
established.  High-cost  items  and  associated  drivers  are  identified.  Hardware  and  function 
element  managers  identify  cost-reducing  trades  and  englneei ing  changes.  Management  decides 
if  recommendations  on  trades  will  be  implemented.  Costs  are  tracked  to  determine  if  cost 
is  in  control  and  if  cost  reduction  measures  are  effective. 


tNGINffRING  CHANGE  PROPOSALS 


FIGURE  12  COST  EVALUATION  OF  ENGINEERING  CHANCES 

All  prop  sed  engineering  changes  are  processed  on  a F-16  Change  Request  as  shown 
abo\".  The  change  request  is  technically  reviewed  and  an  assessment  of  the  deslgn-to-cost 
\ and  life-cycle  cost  Is  made.  The  Estimating  Department  roakej  a cost  estimate  of  the 

change's  a.  oact  on  development  and  production.  A preliminary  estimate  is  made  of  logistic 
support  cost  based  upon  design  information  on  the  new  characteristics  of  the  FLU’s  lower 
level  components  and  of  the  ground  support  equipment  requirements. 
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FIGURE  13  SUBCONTRACTOR  LIFE-CYCLE  COST  EVALUATION 

Life-cycle  cost  was  a key  criterion  in  major  subcontractor  selections.  Each 
potential  subcontractor's  equipment  was  evaluated  for  life-cycle  cost.  Reliability  was 
one  of  the  prime  inputs  into  this  evaluation.  Prior  to  the  final  evaluation,  considerable 
time  was  spent  with  subcontractors  to  assume  proper  input  data  for  evaluations. 
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INTRODUCTION  - 

Pour  obtenir  dea  materials  de  haute  fiablllt^,  il  eat  ndeessalre  d'uti- 
lieer  dee  m^thodea  adapte'es  et  dea  moyene  specif iquee.  Au  sein  du  Service  Tech- 
nique dee  T^lecommunicationo  de  l'Alr  (STTA),  les  diffrrentee  stapes  de  1'6- 
laboration  de  la  Mobility  aont  men  'ee  de  la  faqon  auivantee  ; 

. cotrpoaant o t on  cherche  & obtenir  dea  proceaaua  de  fabrication  con- 
duisant  & dea  dlapoaitifs  de  fiabilit^  £lev6e. 

. fiabilitd  pr^viaionnelle  I lea  calculB  correapondanta  aont  effectudo 
pour  analyser  les  contrnintee  subiea  par  lea  co"posanta}  a-ieliorer 
la  conception  dea  circuits. 

. essaia  de  fiabilitd  et  de  ddverminace  t 11a  ont  pour  but  de  mettre 
en  Evidence  lea  d^faita  de  Jeunease  et  les  pannea  ayatematlques  et 
de  donner  tine  estimation  dc  la  fiabllitd  proche  de  la  valeur  opera- 
tlonnelle. 

. clauses  de  fiabilitd  t il  s'agit  de  s’aaaurer  que  l'objectif  vise 
est  atteint  par  dea  clauses  de  fiatilite  £nrantle  ou  de  maintenance 
forfaltaire. 

Cea  methodea  ont  dtd  appliquees  recem-ent  aur  des  iiatcriela  d'avloni- 
que  d^velopp^a  aoua  responsibility  du  STTA.  Houa  dccrirons  d'ubord  ces  diffe- 
rentea  mdthodes  et  nous  illustrerons  par  des  applications  a dea  caa  concrete; 
enauite,  nous  donnerons  let  resultats  essentiels  d'une  etude  qui  avait  pour 
but  d'analyaer  aur  un  exemnle  pc.rtirulier;  l'efficacitd  de  ces  nJthod's  du 
point  de  vue  "coflt-f iabilite" , Srfin,  nous  de  a.qerors  les  ens^lcne -ents  esBen- 
tiela  tires  de  1 'application  de  ces  methodes  a des  equipement3  conr.us. 

POLITIQUE  CCNERALE  - 

Ddcrivons  d'abord  les  dirferentes  methodes  appliquees  pour  obtenir 
dea  dqulpementc.  de  haute  fiabilite. 

1-1  .fllveaux  composants. 

Dans  les  marches  d'etudes  et  de  ddvelopne  erts  des  conpoaants  elec-' 
troniqnea  nouveaux,  il  eat  syster.af  iquement  introduit  des  clauses  de  fia- 
bilite comprennnt  dea  essaia  en  contraintes  climat iques  et  mecanioueo  sc- 
ares. On  trouvera  un  exeiple  de  telo  eosais  au  tableau  1.  Le  but  de  ccs 
eoaals  eat  de  faire  apparaitre  les  causes  possibles  de  defalllance  et  de  i 
verifier  que  les  processus  de  fabrication  ccnduicer.t  a dea  dispositlfs  de  l 
flnbllltd  f'levde.  1 

Four  la  fabrication  d’un  materiel,  1 ’approvisi-nnement  des  coiopcsants 
e3t  bien  sQr  de  la  responsabilltd  de  l'industriel  | mais  celui-ci  loit 
choisir  en  priority  lee  "composants  CQ"  ("Controle  Centrilisd  de  Quality") 
e'est-^-dire  ceux  dont  la  quality  est  contrdlce  par  un  orr:  nlme  a^ree, 
le  Service  National  de  la  Qualito  (SNQ),  ou  ceux  oyant  fait  1'objet  d'un 
proqra  me  de  selection  particullfcre  ches  le  fabricait  de  composants.  Male 
cea  derniera  aont  d'un  prlx  de  revient  plus  yievy. 
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i-2.  nablllli  xiMslgnnglla  • 

La  StTA  demand*  en  princlpa  dee  calculs  da  Liability  prevl- 
aionnelle  dans  la  cadre  das  umrchEs  d'dtuda  da  matoriela  ou  sys- 
tkmes  nooveaux  pour  pluoleuro  raisons  t 

- ca  calcul  nEceasite  una  decomposition  complete  du  systems 
et  impliqua  une  analysa  das  contralntee  da  c'uaque  corapo- 
sant  aprfes  1 •Etabllsoement  dea  plana  au  bureau  d'Etudea, 
c'ost  done  une  verification  aupplEmentalre. 

- las  premieres  estimations  obtenues  peuvent  euaclter  dea 
modifications  pour  amEliorer  lea  rEoultats  (cholx  dea 
composants,  conception  dea  circuits  ....) 

- lea  reaultats  peuvent  aervlr  aussi  da  base  A un  plan  da 
maintenance. 

En  ca  qui  conceme  le  choix  das  donneea,  on  proefede  da  la 
fagon  auivante  t 

Si  une  information  a itiafaisanta  concernant  l'utilloatlon 
d'un  module  darns  las  nJmaa  conditiona  que  callee  du  aujet  k l'Etu- 
da  eat  disponible,  elle  doit  8tre  utillsEe  an  pr*->ier. 

En  dehors  da  cetta  possibility,  lea  donnEea  dee  taux  da  dEfail- 
lances  provenant  de  sources  pen E rales  peuvent  Itra  utillsEea, 
mais  doivent  Stre  precisEea  et  justifiEea.  L'utiliaation  du 
HDBK  217  ou  d’un  document  Equivalent  Etabll  par  la  Centre  Natio- 
nal d'Etudea  da  TElecommunlcatlona  (CNET)  eat  recoramandEe.  Quand 
cela  eat  possible,  on  a’efforce  ie  reprendre  lea  calcula  aelon 
dea  aources  diff Erentes,  afin  de  mettre  en  Evidence  la  sensibili- 
ty dea  rEsultata. 

1-3.  Essaia  de  FlabllltE  . 

Lea  es3aio  concernant  lea  matdriels  prototypes  ou  de  sErla. 
Ila  ont  pour  but  d'anelloror  la  Liability  par  la  ml?e  en  Evidence 
dea  defauts  systEmatiquas  A una  pEriode  ou  il  ast  encore  possible 
techniquement  at  firancierement  d'y  porter  remfcde,  et  da  donner 
une  estimation  de  la  Liability  plus  proche  da  sa  valeur  opErati- 
onnalle. 

On  cherche  k rEaiiser  en  laboratcire  dea  conditions  <**en- 
vironnement  climatiques  et  mEcanlques  proches  das  condition*  rE- 
alles  d'utilisatlon. 

Lea  essaia  effectuEa  sont  comparables  k ceux  d 'crita  dana 
la  norma  MIL  781  A ou  dans  la  apEcif lcation  frangaiae  Eq-.’4-al an- 
te (CCT  190). 

On  indiqqera  plus  loin  un  example  d'application  de  cea  ea- 
sels k un  repond-ur  de  bord  (IFF) 

1-4.  DEvcrnln are  . 

La  dEveminape  eat  FopEratlon  qui  conalata  A faire  foncti- 
onner  1*  matEriel,  sous  contraini.es  ou  non,  avant  la  recette  pour 
Eliml.ner  lea  dEfiuts  d*  Jeunesse,  II  eat  trun  oo ivent  effectuE  par 
l’indub.riel  aoli  pour  avoir  plus  de  chances  de  satlofalre  aux  corr 
lltionj  de  recette,  aoit  pour  Evlter  d'avoir  A procc’ier  h trop  da 
reparations  ooaa  garartle,  soil  aur  demands  du  service  tacniqua. 
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La  durde  de  ce  d^verminage  eat  variable  d'un  industrlel  h 
1 'autre  et  depend  de  la  complexity  du  materiel. 

11  aemble  qu'un  eaoai  d'une  vingtaine  d’heurea  aoua  con- 
traintea  thermiquea  et  mecanlquea  prolongd  Jusqu'A  100  heurea  par 
un  rodage  (fonctionnement  simple)  eolt  asaez  efflcave  pour  eiiml- 
ner  lea  ddfauta  de  Jeunesae. 

llais  certaina  industrials  le  prolor.ge  Jusqu'A  200  ou  J50 
heurea.  On  trouvera  plus  loin  dee  exemples  particuliera  de  d<- 
verminage. 

1.5.  Plabilitd  aarantle  . 

Afln  d'obtenir  dea  yquipeinenta  de  haute  fiabllite  un  pro- 

grumrae  ci  't  intrcdulre  una  Clauee  de  Plablllte  Garantle  daua  le 
contrat  achata.  Ce  problems  particullfcrouent  important  aera 

abordy  dana  uce  autre  conference. 

2 - APPLICATIONS  DE3  METHODES  - 

Pour  illuatrer  cea  methodea  generales,  noua  allone  decri- 
re  une  application  dans  le  caa  d'un  radloaltim^tref  le  materiel  eat  tin 
bon  exemple  d'une  part  parce  qu'il  presents  une  excellente  f lability 
(t.:TBP  supdrieur  & 2000  h en  exploitation);  d'autre  part,  il  ae  prSte 
A une  analyse  de  rentability  non  aeul  ement  parce  que  le  coflt  deB  ope- 
rationa  de  promotion  de  la  fiability  n'eat  paa  negligeable  dana  la 
prix  de  revient,  mala  auaai  parce  qu'un  veritable  "Buivt"  de  la  f la- 
bility ft  tous  lea  atadea  du  dyveloppe-.ent  et  de  le  production  a e*e 
lnatalie,  ce  qui  .lonne  une  source  trfcs  importante  de  renBelgnementa  et 
a permla  une  critique  sur  l'efflcaclty  de  cea  procedes,  comma  nous  le 
verrons  plus  loin.  Nous  lllustrerona  egal.roent  cea  methodea  par  leur 
application  sur  d'autres  materiels,  cn  partlculler  dea  repondeura  de 
bord  1PP. 

2.1.  Le  materiel  . 

Le  materiel  de  reference  est  le  coffret  ymetteur-recepteur 
d'un  radio-altim&tre. 

Pour  en  donner  une  breve  description,  noua  diroca  qu'il 
comporte  eeaentiellenent  un  gynerateur  "aolid-&tate"hyperfryquen- 
ce  module  en  frequence  (module  Z1),  un  recepteur  homcdyne  Z2  sui- 
vi  d'un  ampllficateur  Z3  commandant  un  discrlmlnateur  Z7  5 le  si- 
gnal du  discrlmlnateur,  apres  identification  du  signal  requ  par 
un  module  Z6  de  logique  de  rechercha-poursuite,  commande  le  modu- 
lateur  Z5  (done  fonctionnement  en  i-oucle  ferraee)'lea  modulea  Z4 
et  Z8  tranoforment  lee  signaux  internes  en  signaux  d'shitude  ex- 
ploitablea  et  l'allraentation  Z9  aeiivre  h l'ensemi-le  lea  tensions 
utiles.  Sa  complexity  peut  Atre  deflnie  par  les  chlffres  sulvanto: 
600  components,  dont  70  traneistors,  30  circuits  integren  llneai- 
res  et  5 circuits  integres  logiquea. 

2.2,  Plabillte  prevlsl onnelle  . 

Deux  methodea  ont  etd  utillseea  pour  prddire  la  liability. 

Au  atade  developpemeut,  la  methods  maxi mum-minimum  decrite 
dana  le  HDBK  217  A a permls  de  predire  une  gamme  de  valeurr  de 
l.'TBP  alora  que  l'etude  .j'etalt  pas  terminee. 
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Une  fola  connus  laa  schEmas  retenus,  una  deuxikme  Evalua- 
tion a EtE  faita  k partlr  daa  donnEas  du  RADC  66.  Dana  ca  but  una 
analyaa  daa  contralntaa  rEallsEea  aur  ehaqua  compoaant  a peraia 
da  s'aasurer  qua  laa  llraitea  dangereusea  d'utllleatlon  daa  eompo- 
aanta  n'ataient  paa  attalntaa. 

Cca  aaconda  calcula  ont  rEvdlE  una  augmentation  d'environ 
30  £ du  UTBP  par  rapport  & la  premiere  Evaluation,  at  une  rEpar- 
tltion  dlffErentaa  daa  pourcentagea  d'influence  daa  divera  types 
da  compoaanta,  no^amment  1 ' lraportar.ee  prepondErante  das  semi-con- 
ducteura  at  circuits  lntEgrEs  (70  X),  dans  la  taux  dc  pannea. 

Lea  calcula  ont  blen  aOr  nontre  la  repartition  par  modules 
de  la  fiabllltE,  comma  lndlquE  dans  la  tableau  2, 

?. 3.  Cholx  dea  conponants  . 

La  calcul  da  fiabllltE  previsionnelle  ayant  fait  resaortlr 
1' Importance  daa  aerai-conducteurs  at  1 'experience  ayant  montiE 
qua  laa  dlodea  Etaient  gEnerale-iert  bonnes,  un  effort  particuller 
a EtE  fait  sur  lee  translators  et  circuits  lntegrEa.  11s  ont  EtE 
ap,Tovlsionnea  sur  programmes  da  selection  partlcullera  effectues 
che*  la  fobricant  dont  lea  rapports  font  Etc.t  d'un  taux  de  dEchet 
trfco  variable  d'un  lot  k l'autre  | la  moyanne  gEnErale  eat  da  23% 
de  ddcheta  aux  essals  da  adlectlon  avec  dea  valeura  extremes  va- 
riant de  1 & 7 OX  . 

ESi  dehora  das  aemi-eondueteura,  on  a consldErE  avec  atten* 
tion  la  fiabllltE  dea  condenBateurs  chlmiquea  at  dea  r.'lais  Elec- 
tro-magndtiquea.  Ces  deux  types  da  compoaanta  ont  egalcient  dtE 
vlelllis  nrtiflclellement,  sous  tension.  Par  exempla,  pour  las 
condensateurs  chlmiquea,  la  crltfers  de  selection  Etait  la  courant 
de  fulta  apres  viellliasoment  ; pour  las  relais,  on  s'aaaurait 
d'un  fonctionne-ient  correct. 

Pour  las  autraa  compoaanta,  dont  1 'influence  aur  la  fiabl- 
lltE eat  moindre,  comma  la  aontra  1' analyse  de  fiabllltE  previ- 
slonnella,  11a  ont  EtE  approvlaionnEa  aur  liatea  reconnues  par 
l'adminiv tratlon  mllitaire  et  par  les  orcnni8mea  d'Etat  de  contrd- 
la  da  qualltE  (CCQ). 

2.4.  Devcmlnage  . 

2.4.1.  Radloaltlmatra  . 

Pour  ce  radloaltlm&tre,  lea  operations  da  ddvermlnaga  ont 

EtE  faltaa  h 3 niveaux  . 

a)  Aprda  cSblage-montage,  deux  modules  sublaoent  un  vieil- 
llsaament  an  cycles  thermlquaa  d'una  centoine  d'heuree. 
L'un  des  modules,  Z1 , genErateur  hype  rfrEque, ice,  doit 
subir  une  stobll lsatlon  sous  tension  avant  rfeglage  fi- 
nal | catta  stabilisation  Joue  un  r8le  important  da  dE- 
vermlnage  car  ells  Ellralna  les  transistors  UHP  ddfec- 
tueux  et  certalnes  capacltEs  cEramique. 

Un  autre  module,  Z9,  1 'alimentation,  reErlte  un  dEvorml- 
nage  k p rt  at  avant  enrobage  dans  la  vemis,  vu  son 
taux  de  dEchet  ElevE. 
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b)  Apr&s  aa  lemblnge  et  rbglnge,  lea  enaerablea  complete 
aubiaeent,  bouo  tension  nomlnale,  un  devermlnage  en 
cycles  tliermiques  (-40»C,  ♦70«C)  d’une  centaine  d’heu- 
res,  et  en  vibrations. 

c)  Le  materiel  Bublt  enfin  un  rodcge  de  200  h dana  le  la- 
boratoire . 

4.2.  Une  experience  plu3  recente  de  devermlnage  porte  Bur  un 
repond  ur  IF?  de  bord. 

Le  but  de  l'otude  dtait  de  proceder  & dea  eoaais  pour  de- 
terminer le  temps  de  devermlnage  que  doivent  Bublr  les  e- 
quipementa  pour  avoir  une  flablllte  opdrationnelle  optimum 
dea  le  debut  de  leur  utilisation. 

On  a utilise  la  methode  auiva'te  t 

24  apparella  out  et"  prleves  eur  la  production  et  ont  su- 
bl  dea  essais  de  GOO  h dont  400  en  fonctlonnement . 

Le  cycle  dea  easaia  a ete  bati  a portir  dea  essaia  de  fia- 
blllte  decrits  dana  les  normea  MIL  781  A ou  CCT  190  « Bolt 
ur.  cycle  de  temperature  de  - 55*  a 55*0  et  dea  vibrations 
de  0 & 100  Hz  & 2 g appliqu^es  10  mn  par  heure. 

Pour  le  teat  dea  dquipements,  on  a utilise  le  tCBt  Interne 
du  repondeur  comraande  toutes  lea  30  eecondeB,  et  on  a pro- 
edde  h dea  verifications  bi-quotldicnnea  pour  deceler  lea 
eventuellea  degradations  de  performances  dea  princlpaleo 
fonctlone. 

Une  fiche  individuelle  etalt  etablii  pour  cheque  equipemert 
Analysona  lea  reaultata  obtenua  « 

L'eti8emble  dea  equipementa  a totalise  environ  10000  heures 
de  fonctlonnement  et  ces  esaaia  ont  conduit  a deux  types 
d’actlon. 

a)  D'une  part  le  tracd  de  la  courbeitaux  de  defalllance  en 
fonctlon  du  tempo, A pennlo  (tableau  3)  j 

-de  mettre  en  evidence  lea  2 premieres  parties  de  la 
"courbe  en  baignoire",  caracterlatlque  dea  equipementa 
slectrc^iquea, 

-de  proceder  A une  estimation  du  MTPP  a- -uit  deveralna- 
ge  eelon  lea  rfcgles  bien  connuea  dea  loia  d'lnterval- 
leo  de  conflance.  Lea  valeura  correapondaient  d'allle. 
ura  aux  premiers  reaultata  obtenua  en  exploitation. 

-de  determiner  le  tempa  de  devermlnage  necessaire  4 our 
atteindre  le  "fond  de  baignoire";  la  courbe  etant  bien 
caracterlatlque  il  a ete  alarf  de  voir  qu'au  bout  de 
100  h on  avalt  eilmine  lea  principaux  ddfauts  de  Jeu- 
nesae. 

-d’estimer  le  MTBP  aprfes  devermlnage.  11  s'av?>re  que  ce 
dernier  permet  d’augmenter  de  7W  le  MTBP  initiel. 

b)  D'aJtre  part  le  depouillemnt  dea  types  de  pannes  a revi- 
le queries  pdnta  faible3  da  l'equipement,  notamment  des 
mauvais  ionctionnementa d 'elements  mecaniques  au  froid 
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•t  qualquas  typas  da  components  ddfectueux. 

Da a remkdas  ont  dtd  dtudids,  cartalna  allant  Juaqu'k  la 
rafonta  totala  da  cartalna  circuits.  On  peut  atperermda 
augmentation  trka  eubatantielle  du  UTL?  aprka  l’appll 
cation  daa  modifications  sur  las  dquipementa  k produlra. 

Los  modifications  at  enaaignementa  techniquei  tlrda  da 
cas  assais  ont  dtd  las  suivantr  t r enforcement  daa  md- 
ta’ lJsationa  das  trous  da  connexions  da  circuits  double 
far at  utilitd  des  asaais  da  sdlection  pour  ‘in  type  da 
circuits  lntdgrds.  II  est  intdressant  da  notar  qua  l'aug 
mentation  du  prlx  des  composants  sdlactionnds  chex  1-s 
fabriccnts  da  circuits  lntdgrda  n’s  pas  dtd  rdpercutde 
sur  la  prlx  du  matdrlel  ; 11  senble  qu'ella  alt  dtd 
compensde  par  une  diminution  du  cofit  da  fabrication-con 
trfile-rdparation  des  cartes  en  cours  da  production  ou  la 
nombra  da  ddfaillance  dtalt  trka  dlevd  a rant  la  ddveml- 
nage  das  circuits. 

Cas  actions  ont  dtd  trka  efficacas  pulc*!aucune  panna  da 
mdtalllsation  n'est  apparua  Ion  des  assais  at  quo  las 
circuits  lntegrda  ont  montrd  une  mallleure  flabllltd. 

2.5.  Essals  da  flabllltd  . 

On  affectue  aasez  souvent  des  assais  da  flabllltd  selon 
lse  rormes  -IL  761  A ou  CCT  190. 

On  vs  ddcrlre  una  application  partlcullkra  da  cea  essals 
da  flabllltd  k un  autre  typa  da  rdpondcur  da  bord  Iff. 

Un  das  buts  da  cet  esral  da  flabllltd  dtalt  d'obtenlr,  ou- 
tre l'amdlioration  de  la  flabllltd,  la  mellleure  connaissanca  pos- 
sible du  KTLP  en  exploitation  rdelle.  II  a fallu  done  falra  plu- 
aleurs  adaptations  das  cycles  d'asoais  ddcrlts  dans  la  norma  KIL 
781  A pour  se  rapprochsr  au  mleux  des  conditions  reellas  mdcani- 
quas  at  thermlquas  (cf. tableau  nt  4). 

Lea  principal*  rdsul  tats  obtenus  de  cas  essals  sont  les 
sulvanta  | 

- cop.p  raison  daa  ..'TUP  obtenus  par  la  calcul  prdrisionnel , 
par  les  assais  da  fiablltd,  an  exploitation  rdelle  « 

. par  la  calcul  (RADC)  t 600  h 

. par  lea  assais  t 470  h 

. an  fonctionneraent  rdel  660  h 

- On  a pu  dgaleaent  obtenlr  d'autres  rens eigne -ants  i 

. trfcs  grande  influence  de  la  loi  de  variation 
du  cycle  da  temperature  at  da  vibration. 

• ddtermlnation  de  la  durde  optimale  du  ddvernlnage 
(30  heuras  dans  re  cas  particulier) 

. une  connalnaance  afire  du  comporte-ent  da  l'dqui- 
penant,  p^raettant  la  ndgociutlon  da  Clausa  da 
flabllltd  garantie. 
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De  fagon  trka  generals,  le  ITTA  conai fere  comma  tr^a  iruc- 
tveux  lea  eesals  da  fiabilite  en  labor^tolre;  au  niveau  dco  proto- 
types at  da  la  preo^rle,  11s  permettent  de  detecter  lea  "erreura" 
da  f lability  au  niveau  de  la  adrle,  ila  donnent  une  approxima- 
tion sotiafaleaote  du  MTB?  op^ratiorwel , qul  permet  une  meilleure 
maintenance  (calcul  dee  reohangea ) et  donnc  dea  dlementa  lndiapen- 
eablea  pour  ^Introduction  dans  un  contrat  d'une  clause  de  flabl- 
litd  garantle. 

3 - EFFICACITE  DEE  ^BTHOTES  - 
3 • 1 .O^nerallt^a . 

Nous  venona  da  voir  que,  pour  obtenlr  une  bonne  fiablllld, 

11  faut  des  methodes  k tous  lea  niveaux  « lors  de  la  conception 
de  1 '^quipeient,  dana  le  choix  et  la  selection  de  sea  com, osar ta 
conntltutlfa  a travere  lea  procedes  de  fabrication  retenua,  auoai 
blen  qu’a  l'occaaion  d'e33ais  de  toutes  30rtea  ou  d’une  politique 
de  contrfile  de  quality  aussi,  chaque  phase  de  la  vie  d’un  dquipe- 
-ent  Electronique  permet,  dea  actions  en  faveur  d’une  nellleure 
fiabilites  a ch  cu-  e de  tea  actions  correspond  un  coGt  accessible 
k partir  de  la  comptabilite  analytlque  de  l’unite  lndustrlelle  qui 
produit  1 ’equlpememnt  mais  il  est  le  plus  so  vent  impossible  ”aa- 
socier  egaleaent  une  efficaeltd  k chacune  des  actions  conslderEes. 
Cette  situation  tlent  a la  nature  proba'oiliate  de  la  fiabilitE  - 
et  des  ,-randeura  qui  lui  aont  associEes  (KTBF,  taux  de  panne)  - 
qui  en  rend  alalsEe  la  meaure  et  a \ ’ insufflaance  dea  .sett-odea 
analytiquea  de  caractere  general. 

I'ne  Etude  apeciflque  a EtE  lancee  et  avalt  pour  objet  d’ex- 
tralre,  a partir  de  donndes  reelles,  des  relations  quantitatives 
llant  1 ’amelioration  de  la  fiabilite  d'un  equipe-ent  Electronique 
a 1 ’accrolsse ient  correspondant  de  aon  cout.  Ce3  relations  devai- 
ent  deter-. lner,  en  quelqur  rort?,  1:  "cout-ef ficacitE"  de3  Jiffe- 
rents  moye:-.a  que  l’on  peut  mettre  en  oeuvre  dans  la  realisation 
d'un  Equipe  ent  electronique  pour  en  augnenter  la  fiabilite  ; 
leur  utilisation  per  tet  ainnl  de  choisir  le  juste  poids  k donner 
k chacun  de  ces  moyena  afln  d’atteindre  le  pli*  econoniquement  pos- 
elble  un  objectif  de  fiabilite  fixE.  Four  que  cette  etude  soit  con- 
crete, elle  a EtE  appliquee  au  ralloaltimktre  dont  noua  avons  de- 
ju  p .rle. 

3.2.  Precede  d'analyae  des  -neftpder.. 

E'Etude  utlllsait  les  informations  recueillies  our  chaine 
de  production  du  raJio-alti metre  qul  a foumi  en  troln  ans  plus  de 
< un  mllller  d'Equipements  ce  qul  a permia  d'accumuler  un  tree  grand 

nonbre  de  donnEes  « 

. dea  donnEes  de  dEfai’lance  8urvemies  a l'equipe-ent  ou  a 
l’un  de  sea  aouo-ensemblea  lora  d'essaia  de  roda.-e;  noua 
admettron8  en  premiere  approximation  que  le  ...TCP  alnoi 
/ entimE  eat  un  lndlcatcur  suffisament  fidkle-  de  la  fiabi- 

lite opEratlonnelle  de  J.'equipement  ce  qui  a 6t«?  vE.rifiE 
par  allleura. 

. dea  donnEes  d'identi flcatlon  dc  toutes  les  operations 
• effoctuEeo  aur  la  halne  de  fabrication  depuio  son  dE- 

marrage  (npprovloionne nente,  eaoais,  controle,  etc...) 
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Lea  renselgne nents  diaponiblea  sur  3000  Interventions  ont 
dtd  tranecrlt*  Bur  un  flchler  d 'environ  20000  blocs  de  80  carac- 
tfere*. 

Pour  Juger  de  I'afflcacltd  dee  mdthodee  d'augmentatlon 
de  la  flabillty  on  a utlllad  toutea  lea  reaaourcee  de  l'analyse 
atatlstlque  et  fadfcrlelle. 

L'analyse  d'efflcacltd  des  operations  d#  f lablllaatlon  a 
itc  d 'autre  pert  facilltee  dnomeraent  par  la  quality  dea  rdpara- 
tlons  It  chaque  atade  i 

una  premiers  analyse  nontre  qu'au  niveau  de  l'dqulpement 
11  n'y  a pas  d'lnfluence  murquee  d'une  intervention  but  la  via  ul- 
t^rl’ure  da  l’yqulper.emnt  et  done  qua  lea  tralteoenta  da  flablll- 
satlon  ont  dea  consequences  independents*  au  niveau  d'un  dqulpa- 
ment  donnd. 

3.3«Crltlque  dea  m^thodes. 

Lea  differentes  actions  axposdes  precedement  condulaent 
a una  analyse  critique  a tous  niveau*  t 

-Critique  du  dossier  de  fabrlcavlon  et  du  calcul  de  flabillty 
previstonnelle- 

On  peut  d'abord  contrfller  lea  previsions  de  flabillty. 

Lee  8eml-conducteurs  font  ef fectlvement  l'essentiel  de  la 
flabillty  k long  terme  de  l'rfqulpeieat,  male  las  circuits  lntdgrda 
Jouent  un  rflle  primordial,  d'autant  plus  que  dans  ce  cas  la  proce- 
dure de  selection  en  flabillty  est  asse*  peu  efflcace. 

La  repartition  des  pannes  suit  relatlvement  bien  las  provi- 
sions t lea  modules  '.1,  Z6  et  19  sont  effectlvement  les  plus  fragl- 
las  mala  si  les  '^alliances  de  71  at  Z6  sont  neutres  pour  la  lia- 
bility k long  terme,  un  taux  de  dyfalllance  ^levd  l«  dlodesds  puia- 
sancedans  1 'all nentatlon  est  sirne  certain  de  fragility  at  de  fati- 
gue vralse  iblable  a une  ycheance  plus  ou  molns  bre"e. 

-Critique  de  la  selection  des  co-posants  - 

Four  les  ^apacltda  cni’iquea,  le  viellllssement  avec  surve- 
illance du  courant  de  fuite  a ote  efficacc,  d'autant  plus  qua  la 
3 jng-ie  pi'riode  de  repoa  qui  a suivl  ce  vielllioaement,  avant  monta- 
ge et  re  ’ise  eous  tension,  a permia  h nonbre  d^ldnents  douteux  da 
continuer  ^ evoluer  et  i'ftre  cli-.lnea  i pour  ce  type  de  compoaant, 
l'actlon  dea  cycles  de  vleill laaeient  est  muintesant  bien  connu  et 
periet  d'envlsager  un  node  de  selection  du  erne  type,  plue  rapide. 

Pour  les  circuits  intc'gres  et  les  transistors  a effet  de 
cha-.ps,  le  mode  de  selection  s’esb  revel«?  peu  efflcace.  1 

Les  lots  our  leoquels  le  fabrlcunt  donne  un  taux  de  dechet 
*n  eeaais  de  flablllsatlon  superleur  i la  noyenne  ont  lors  les 
opdrntlons  cuivontes  et  en  exploitation  une  mortality  sup(?rleura 
ygole-ent.  1*  renforcerent  des  eesala  de  f labi liaation  et  des  eon- 
trSleo  a augmenty  le  taux  de  dechet  lor3  de  ces  essala  sans  que 
1* Influence  a'en  faoo  sentlr  par  la  suite. 

11  n'eut  toutefols  pus  certain  que  cette  selection  n'alt 
cu  eucun  effet  benofique  i '»  cause  dee  dechete  inportante  en  fiabl- 
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lination  »t  auosi  de  dole&ncea  r^pet^ee , le  fabrlcant  a livre,  our 
la  fin  de  la  perlode  de  fabrication,  des  lota  tres  nctte-.cnt  neil- 
leuro. 

Four  les  transistors  blpoluires,  l’^nalyse  factorielle 
ne  per~et  pas  de  tlrer  de  conclunlons  t en  exploitation  comme  en 
fabrication,  le  taux  de  defaillance  reate  bas  et  aenble  con  erver 
un  c ratere  parfaitement  aleatoire. 

- Crltliue  dea  devormlne  ~*ea  - 

• Des  operations  de  d^veminage  cnt  etc  effectuees  aur  dsax 
modules  Z1  (gcnerateur  UHP)  et  Z9  (alimentation).  Deo  analyses  mon- 
trent  le  r^sultat  cuxvant  t 

le  t-om  iorte -.ent  de  ces  daux  nodules  est  tres  different  t 
autant  le  devermlnage  Gamble  e:'ficace  sur  le  module  Z9,  autant  1» 
rerultat  setble  peu  conv  incant  pour  le  nodule  Z1  Lien  qu’un 
vielllisser.er  t no  is  tender,  soit  ab3olument  nJcessaire  avant  recla- 
me fln.l,  pour  palller  la  derive  (souvert  de  tructive)  des  caraetd- 
ri  ti  :ueo  dc  trandntors. 

• Pour  lc  dOverminage  des  ensembles  complets,  on  constate 
cue  pre3  de  la  moitie  des  defaillancee  des  20  premieres  neureB 
correspondent  4 des  defauts  de  fabrication  cul,  dans  ce  cas,  sont 
parfaltenent  elininec  et  n’ont  plus  d’incidence sur  la  suite  j la 
conclusion  qu’on  peut  en  tlrer  est  que  ces  20  premieres  heures  de 
dever.vinage  ont  permis  de  dimlnuer  d’environ  40  le  nombre  de  defeats 

prematures  en  exploitation  s ces  20  premieres  heures  jouent 
tier,  le  role  de  deveminage  qu’on  attendalt  de  l’easai. 

Des  autres  defauts  detect^s  pendant  ces  heur“3  initialed 
He  devermlnage  cont  du  m?me  type  que  ceux  detect '3  par  la  suite  de 
'•essai.  faction  de  d ever  inn, ge  r.’e3t  evidente  que  pour  les  in  uc- 
tar.ces,  les  capacites  chimicues  et  pour  lea  diodes  redres3eu3es  de 
1 ’alimentation. 

P*ur  les  circuits  integres  et  le3  transistors  a effet  de 
cbamp3,  le  taux  do  defaillancerj  pendant  l’essai  est  ur.  indice  de 
la  quail td  du  lot. 

Re3lr  a interpreter  faction  glotale  de  l’essal  : a-t-on 
elinine  par  cet  essai  la  T.ajeure  partle  de  dof alliances  a plus 
ou  r.oins  court  terr-e  en  exploitation  ? 01  on  analyse  les  Hm'=- 
rents  acpects,  on  peut  conclure  que  l’efficacitd  du  devermina ge 
eat  certaine,  r.ie  ou • en  coroSaire  on  provoque  des  defaillances  qui 
n'on  aucun  rapport  avec  la  fiabillte  lorsque  Is  deveminage  pra- 
tique est  trop  dur,  surtout  i or.  le  prolonge  au  deli  de  20  heures. 

- Critique  du  procesous  Industrie!  de  regulation  de  la  .iacii.xte  - 

Deux  boucles  de  contre-reaction  prir.cipe.les  etair.t  nenseea 
assurer  jrc  certair.e  3tabllite  de  la  qualite  et  de  la  fiabilite  du 
produit  fini  ! une  contre-reaction  basee  eur  la  qualinJtrie  du  con- 
‘role  lndustrlel  d’une  part,  et  une  secor.de  baxde  our  la  merure  !e 
:..Tr,P  en  essais  d devermlnage  d'ense.m.ble.  fannlyse  du  processus  a 
montre  rue  la  fonctlon  de  transfert  des  boucles  de  contre-reaction 
etait  ir.adaptde,  no  tarn.- ent  h cause  de  sa  constants  de  temps 

~n  eTfet  un  contrSle  industrial  dor.t  les  reactions  inter- 
vlc r.r.cnt  trop  lor.gte  mpa.^aprta  la  fabric ution  est  ir.efficsce  si 
ps-.di-  r.t  )e  te  po  ecoulr  er.tre  la  det-ction  des  premiers  de.’auts, 
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1«  determination  uf  l»*ur  caune  ( out 1 1 luge  J<'r»etueux,  personnel 
inn1,  p t «■ ) et  lo  re  .''de,  e no-.troux  cquipe'-.er.tri  continuf’r.t  a nu- 
blr  loa  * o l.'f.  jt  . 

loir  In  to  cic  re  fiatillt'  bauc-‘  nur  ler.  r.'.TJl  t ut3  en  (le- 
ver ’linage,  aon  effet  r'guluteur  ‘i  court  ou  moye.i  terme  cot  nul  pule 
que  le  taux  de  d/iailluce  \ ce  niveau  no  repri'oente  pan  In  flabl- 
11  to  Ju  innt  'rl c'  , 

• -!■■■'•’ "T'  "J  uC’jt  de.:  epevno:::;  :>e  fia;  lili"ation  . 

La  prime  a payer  pour  proiuire  un  rn^loaltlnotre  de  benne 
fiatlllte  avec  le  proceoouo  de  fabrication  Initial  etait  d'envi- 
ron  30  » du  prlx  de  '•evlTt  de  l’»'  ':uipe-ent,  le  cout  de  la  selec- 
tion dea  co-.pooanto  y lntervenant  pour  19j:  et  les  operations  de 
determinate  et  de  contrSle  pour  un  pourcer*'age  a peu  pieo  ldenti- 
que . 

A tltre  d'exemple,  on.  peut  faire  un  tableau  (cf. tableau  5) 
de  la  relation  rout-ef ficacltd  deo  opbrationa  de  fial lliaatlon 
des  semi-conducteura  cctlfn,  dor.t  le  taux  de  dcfrillar.ee  eot  im- 
portant par  rapport  au  taux  defaillance  global  de  l'dquipe.ment  » 
ces  oemi-conducteura  actlfs  sont  en  caua#  dana  deux  def nillar.cee 
sur  troia. 

En  moyenne,  la  formule  d'ap.  roxination  do  la  sur-prime  3 
qui  a ate  payde  au  fo  urnisaeur  pour  lea  operations  de  selection 
peut  a'ecrlre  t 

S AS  * P/3 

L' analyse  d'efflcacltd  a auggerd  un  moyen  dc  di-lnuer  no- 
tablenent  le  budget  "fiabilite"  et  aana  doute  de  le  limiter  4 une 
aur-prlme  de  l'ordre  de  10-''.  En  effet,  1’ analyse  montre  que  nalgrd 
toutea  lea  precautions,  la  flabilltd  du  materiel  reate  une  fonction 
directo  de  la  qualltd  dea  plfecea  ddtachees. 

La  procedure  i relenir  pour  obtenir  le  meilleur  compromla 
prix-fiabllltd  aeralt  la  :;uiv3nte. 

- r;#me  si  l'efflcacltd  rdelle  dea  operations  de  selection 
dea  compoaants  eat  falble,  c'e3t  h dire  ai  on  elimine  au- 
tant  de  "bona"  compoBanta  que  de'nnuvalB',  toutea  cellea 
qui  ont  etd  faltea  ae  Justifient  (par  exemplc,  pour  lea 
transistors  et  circuits  integrds,  il  faudrait  que  plus  da 
80.'  de.  ddcheta  & cea  eaaaia  aolent  artificiela  pour  que 
le  proeddd  perde  de  3on  lnt.'rSt). 

- le  deverminage  du  module  29  aurait  pu  Itre  remplnce  de  fa- 
qon  dconomique  par  cette  selection  dea  diodea  de  pulssatice 
au  atade  du  componant  ; 

- la  taux  de  defaillance  des  composanta  " a la  miae  aoua  ten- 
alon  " doit  Stre  retenu  come  critfcre  pour  ddcid.-r  8*il 
faut  ranforcer  ou  au  contraire  relacher  la  advdritd  des 
operations  de  selection  en  unont. 

- un  deverminage  d'enaemble  d'une  vingtalne  d'heuraa  eat  ef- 
ficaca  t la  plupart  dee  defauts  constates  h ce  atade  au- 
raiant  entraine  un  ddfaut  da  Jeune6ae  an  exploitation  s 

par  contra,  il  n'eat  pea  utile  de  prolonger  la  ddverralnagee 
on  fait  alors  apporaltre,  en  plus  de  defaillancaa  aana  dou- 
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te  lidea  & des  ddfauts  de  jeunesae,  trop  de  d^falllances 
artificielles  pour  quo  le  procddd  ooit  Justifiable  dans 
la  cas  g^ndral  5 

- le  rodage  au  banc,  auno  contr  3 ea  climetiquea,  eat  int£- 
ressant  pour  ae  faire  une  idet  alable  de  la  fiabilitd  d'ex 
ploitation,  mais  en  tant  qu'outil  de  fiabiliaation,  il  ne 
faudrait  y faire  paoaer  ey3temntlqueinemnt  lea  dquipementa 
que  si  la  t.'TUF  aur  un  preleveraerjit  eat  nettem.nt  infdrleu- 
re  h la  UTBP  objectif. 

- enfin  et  aurtout,  une  politique  eonstante  de  haute  fiabi- 
litd  pour  ce  natdriel  donne  de  »ai;on  gratuite  un  excellent 
rdaultat  a long  terne  t lea  reactions  chez  lea  lorniaaeurB 
de  corposant  ont  nbouti  k la  ft  rniturede  pieces  de  aeil- 
leure  quality  et  de  meilicure  fiabilite. 


4 - eorcLusioN  - 

De  l'enaerable  des  tr- vaux  qui  viennent  d'Stre  decrita  et 
en  particulier  dt  l’etude  de  "cout-ef ficacite"  dea  methodes  de  fiabili- 
te appliqude  a un  radio-aiti metre,  on  peut  tirer  quelques  concluaiox,3 
simples. 

La  plus  grande  conclucioi  eat  une  conclusion  de  bon  eeno 
(et  ce  n'eat  paa  decevant  daria  la  Tenure  ou  le  bon  sens  l'eat  pas 
Evident):  on  ne  fait  pas  de  la"haute  fiabilite"  avec  dea  movens  "arti- 
ficials"; 11  faut  de  "bona  composanta"  et  un  "travail  propre"  pour  lea 
assembler.  En  effet,  il  aerait  illuaoire  de  vouloir  rattraper  par  dea 
esaaia  de  devermlnage  ou  autrea  une  fabrication  imparfaite  avec  de 
mauvais  conposanta. 

L'autre  grande  conclucion  eot  que  pour  appliquer  ceo  me- 
thode8  ei'plea  e a^assurer  de  leur  efficacitd,  il  faut  interver.ir  a 
touo  lea  ftadea  de  la  vie  de  l'^quipenent  : developpeinent  et  utilisa- 
tion de  bona  compoaants,  analyse  ddtaillee  du  projet  p:.r  des  calcula 
de  fiabilite  previsionnolle , fabrication  soignee,  vdrifl^e  et  conpld- 
tee  par  des  d^vernir.ages  et  des  essais  de  fiabilite  judicieuoement 
choisis,  au  niveau  de  lour  duree  et  au  niveau  des  contralntes  ap.li- 
quee3. 


Ce  texte  eat  parti ellement  base  sur  dea  travaux  realises  par  TRT  sous  contrat 
3TTA  7206007  et  avec  Li.T  soua  contrat  3TTA  7483017. 
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Table  1 


Essais 

Nombre 

Conditions 

d'essala 

Konbre  de  cycles  d'e^rale 
ou  contraintes  ochelonn^ee 

Obo  '.rvutione 

Etoncb<?lt4 

Totalite 

Detection 
de  fuites 
-par  Helium 
-par  llquide 

Let.  essaiB  d’etunclitlte  pour- 
ront  t-ventuelle -er.t  ctre  re- 
pris  aprea  une  aerie  d’essals 
mecanlques  et  climatiques 

-eaures  a,rrea 
chaque  serie 
de  cycle. 

lesure  apreo 
chaque  aerie 
de  cycle 

Varatlons 
rapides  de 
tenperature 

5 

CCTU  01-01A 
par  5B 
( cthode  A) 
-55«C  ♦125«C 

5 - 10-20-40 

Choca 

themiques 

5 

0 ♦ 100«C 
CCTU  01-01  A 
par  S.B 
(V.ethode  B) 

5 _ 10-20-40 

Temperature 

(0 

4 H de  otoc 
kage  h cha- 
que  tempera- 
ture d'esaai 

2H  de  reprise 

Temperature  echelonn^ea 
23»C  150«C 

100SC  175*C 

125»C  200SC 

au-delk,  de  25®C  en  25*C 
JuaqiA  destruction 

ilesure  a la 
tenperature 
de  25 *C  *28 C 
apr<  a chaque 
reprise 

Choca 

5 

0,5  ma 
0,2  ma 

1500  - 2000  - 2500  - 3000  g 

i.esurc  aprfes 
chaqut  ecsul 

Vibrations 
1-Essaig  k f 
croissants 

5 

Dalayage  de 
100  A 2000Hz 
aux  accele- 
rations 
succeaalvea 

10-20-30g 

1 cycle  de  duree  de  15  minutes 

2-Cycles 

r^pctea 

5 

Balayage  de 
10  k 2000Hz 
k g constant 
(par  exemple 

20g) 

•lesures  aprea  20  cycles 
30-40-50cyclea 

Acceleration 

constants 

5 

CCTU  01-01  A 

Uesures  aprts  10000  g 
15000  g - 20000  g et  au-dela 
Juaqu'a  100000  * 

Table  2 


Sub-unita 

R ' 
(£) 

Influence  percentages  due 

to 

C 

(..) 

Semi-C 
(.  ) 

C%r»  Ir.t 
(,  ) 

Poten 
(.  ) 

I/.agne 

U) 

Conne 
( ) 

Divers 

(:.) 

'£  Total 

<.1 

0.6 

*.3 

94.3 

0.0 

U.U 

2.7 

0.2 

u.O 

14.3 

Z? 

c.o 

C.C 

99.1 

0.0 

r.o 

0.0 

0.9 

C.O 

6.0 

Z3 

4.9 

4.4 

30.4 

57.0 

».7 

1.0 

0.6 

0.0 

3.5 

Z4 

1.2 

O.B 

75.3 

21.4 

1.2 

0.0 

0.1 

0.0 

10.1 

25 

1.5 

0,0 

64.2 

32.5 

0.4 

0.3 

0.1 

0.0 

15.4 

Z6 

2.0 

0.7 

30.0 

66.1 

1.0 

0.0 

0.1 

0.1 

12.7 

Z7 

2.4 

1.7 

94.1 

0.0 

0.0 

1.7 

0.2 

0.0 

0.5 

ZB 

1.4 

0.8 

72.4 

23.2 

2.0 

0.0 

0.1 

0.0 

9.3 

Z9 

2.4 

7.2 

48.2 

37.0 

0.0 

0.5 

0.1 

3.0 

7.6 

Z10 

0.0 

0.0 

0.0 

0.0 

— 

0.0 

0.0 

0.1 

94.2 

12.0 

\ 


Table  5 


coot  price 
waste  rate 


process 

effectiveness  el 
ninated  componen 


mean  cost  of  an  ell 
ninated  component 


components 

selection 

applied 

voltage 

v.hole 

equipment 

burn-in 

warranty  in 
operational 
phase 

total 

225 

150 

90 

60 

e25 

23  ; 

2 

0*6  to 

0.2 

(26  ,:) 

05 

(burn-in 
of  21  and 
Z9) 

50  .*■ 

ioo  :: 

10  a 25 

90 

300 

300 

< 
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0.  IhTl.OuUCTI  ot; 

To  obtain  hl(;k'  reliability  equipment,  it  1.;  n<  re  ..ary  to  un-  appropriate 
methods  >n«i  np.  ci  fie  testin' -pi.  r..  At  tin-  "Le  rvls.r  Technique  d<  r.  ?•’  i.'-e.  omnuri  loot  Ion  - 
il>  I'Air"  (d?TA  : Alt  i-o:\..;  T 1.  cor.iiunlcutlon:.  Technical  D' par  tne-nt ) , the  'a:  lout 
phases  of  rt  liability  «J»  veloprt*  iu  on  conlu.  t<-J  an  follows  : 

- • o:n  >,  nrntn  : efforts  are  dire  :t<  d tawa.-et.  thi«-  achievement  of  nanufar  turln,, 

,’i  on  .;.,i  1*  adln0  to  hi„h  reliability  devicis. 

- reliability  preliction  : .pc-opriat.-  calculations  are  carried  out  to  in-ily/t 
tilt  stre...  v.s  to  wliit.ii  tf  1,'on  nt.  art  submitted  and  improve  circuit  design. 

- reliability  and  burn-in  tests.  : tii-.-ir  pa:  p.:;c  1 r.  to  reveal  early  one:  at  lor. 
defect-  and  systematic  failure will  as  to  give  .in  estimation  of  relia- 
bility clone  to  tiie  opei  at  Iona  1 value. 

- reliability  clauses  : guaranteed  reliability  o"  rontrnctuol  maintenance 
clauses  en-u.'f  tint  the  aim  in  vie.  has  been  :r-a  i.ed. 

Tin  above  methods,  which  have  b>  an  appli-d  recent.lv  to  avion!  r;:  equipment 
develop.  d uiaie-r  the  sponso. chi p of  ./ill  b«  first  d*  scribed  and  11  iur ' i !.t' d 

by  apoli- ati  sits  to  concrete-  cast  s : then,  we  will  present  the  main  rrr.ul  of  a 
study  which  a in.  d at  amly  In,,  the.  efficiency  of  such  methods,  from  tie.  "ros.t- 
-itjifbility"  standpoint,  for  a p-.rtiouli.  ei  impl  e . finally,  we  will  bring  out 
th“  essential  lessons  learnt,  froa  the  <ppli. ration  of  there  methods  to  hnown  equip- 
ts nt, 

1.  Ghiic,.AL  POLICY 


no  /ill  first  0lve  .)  dc ::  nipt ; on  o.  the  v-rioms  methods  used  to  obtain  high 
reliable ity  equipment . 

1.1,  Component  Level 

:.t  liability  1 iures  Including  t.  :t  rondu'ti-i  un  e r revert-  •.limtlc  and 
n«  chanical  condition:'  ate  systematically  introduced  int  > n- el*  oti  on  id  comp  om-nt 
design  ani  development  contracts.  An  exanpl-  / ' cu.i;  tcr.tr  ir.  given  in  table  1. 

The  purpose  of  thert  torts  is.  to  br>n,_,  out  tie'  po.-riblc  caureo  of  failure 
anV  to  insure  tint  the  m.inufactu  "in,.  proo  r 1.  id  t i hi„h  reliability  devices. 

Ac  fa’-  as  tin.  tiaiiuf.i  turi.n^  of  pi'C<  o'  e ;ui  —lent  i'  or-nct  rned,  the 
responr ibllity  >f  purchasing  c nt-.  v-lv.  c obviour.lv  on  thf  manufacturer  ; 

however,  tin-  la  iter  must  glv<  : < net  te  comp  ora  nt::"  (Cd-  : Control*  C<  n- 

t -■  ■*!  i n.*  dc-  aUaltte  - Cent:  ill:*  d .unlit;/  .on'rol),  that  is  to  say  lomponents  whose 
quality  is  cntrolltd  b;  a national  o: ..  mi -at  ion  coll  til  ‘•ftr'.it  Ilitlonal  de  la 
aualit.;”  (dli..  : national  .unlit./  Dco.irtr.ent) , or  to  those  sell  ettd  th:  nugh  a 
specific  pr  /gram*  by  tv  component  mmcY  - •:  t un.  r.  Ha  •»*•:  , th*  litter  are  more 
costly. 

'.f.  ...liability  hr/ diet'  an 

d.  u centra,  tin.  for  tin  -j-  l,  i.  •.  ' in  ■■  t : i >1  >r  yst.-s-,  i ?TA  n.-qu*st:  , 
as  . :ul",  tii-t  ja  ' ! .1.1 i •_>»  lreditlar.  - ul.-t:  'r.s  h.  ; — i - -J  out,  ' v -»  v.  t .il 

a .-anc  : 

- su  h s.j  "ul.-ti  on.  rt-ui-  t!.-  s : . b-  i • t*  1 y cr-'ht  n ■ r int . 

its  constituent  nart?  ani  i . at: . sr  .n.*  lyric  . , t a ss.p.r.-  nt , 

followinc  t!..  d:  _ ;i:iw  a - . 1 a.,  in  t'.  d'Si;  i.  !<  :•  a t“l.  nt  ; ti'a  r;  f t , 

l hi  r O'  as  'idd  ' t : ill  1 1 ,:he  l- : :i_ . 

- tl.  fi-.-t  . : 1 1 . t * •»!.-  i fc:  in-  i y 1.  ..  J t->  : t - 1 i f i - . . t : >s.  • •*'»  i-.y 

v i.  • o.  ’•  ultr  (se'.ti.tin  -f  .m  ion.  r.tr.  i:  "lit  !.  ‘._ti...). 

- t’a  re- suits  obt  lined  . .n  ..I-'  he  n r * - 1 ii.s':  f : . r.  .r..  • 

p.  _ia-i,ie. 

At  • -•  th.  a 1 r ' t i o:i  of  inf.,  i-'..ui,  t:.<  f ir.  p f'.i  - 


U a.c 


if  . a . i . in  i -i:  -n  h.  u.  . ■>;  : .*s.  o.iul  • ur.d  r th*  . v;  >r. : i - 

ti.i  i t'  . . ..n.  1 i.  : i d ! ..  av  . i * , : i r. . i :.  • : ul  i l ••  u . d f : . . * . 


a.  . i . ■ . til.,  a i.  .- : t,  ‘ ! i t ; , f .ills,  : . . 

.an  b u.a  ; • th-  • ..  >-  • i..-  a.  > i t ’ 

i '"'•■’il  . • ..  -.i-i-n.  on'.,!;  !n  d tc  Vi  ” i.  ..  . s,  - 

: iiat'  >fi  1 <.■  iitr.  fo:  Ltu  t'  • . an  fa  ■-  -,.,:ii 

pis  : i;li  , th.  a . .a ! s<  l -ns  -J.  rlv.-.i  f:  v dll  ■ . i;t  s 

if.  e hr  t > <•;.  i tt  vi  t"  sf  P r-  .ut  • . 


i 


1 
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1.3.  K> liability  Testing 

The  si'  tests  art'  conducted  on  prototype  or  mass-produced  material.  Their 
objective  la  to  improve  r. ■liability  by  detecting  systematic  defects  at  a stage  when 
it  Is  still  possible  to  remedy  them  from  both  teclinlcal  and  financial  standpoints, 
and  to  give  an  estimate  of  reliability  closer  to  the  operational  value. 

Lfforts  are  nade  to  achieve.  In  the  laboratory,  climatic  and  mechanical 
environment  conditions  close  to  those  prevailing  under  operational  conditions. 

The  tests  carried  out  are  similar  to  those  descrlbod  In  the  specifications 
MIL  781  A or  In  the  equivalent  French  specifications  (CCT  190). 

Ar  example  of  the  application  of  such  tests  to  an  airborne  transponder 
(IFF)  will  be  t,ivcn  later  on. 

l.A.  Du:n-in  Phase 

Burn-in  consists  In  running  the  material,  with  o"  without  stresses,  prior 
to  acceptance,  in  order  to  eliminate  the  early  operational  defects.  This  operation 
is  very  frequently  performed  by  the  manufacturer,  either  to  have  more  chance  of 
meeting  the  acceptance  conditions,  or  to  avoid  making  toe  "any  repairs  during  the 
period  of  warranty,  or  at  the  request  of  the  technical  service. 

The  duration  of  the  burn-in  period  varies  according  to  the  manufacturer 
concerned  and  depends  on  the  complexity  of  the  material. 

A test  performed  under  thermal  and  mechanical  stresses,  lasting  approxi- 
mately 20  hours  and  prolonged  up  to  100  hours  by  a burn-in  period  (simple  opera- 
tion) seems  to  be  efficient  enough  to  remove  early  defects.  However,  it  is  extended 
by  some  manufacturers  up  to  20u  or  350  hours.  Specific  bum-in  examples  will  be 
presented  further  on. 

1.3.  Guaranteed  reliability 

In  order  to  obtain  high  reliability  equipment,  a Guaranteed  Reliability 
Clause  must  be  added  to  the  purchase  contract.  Tills  most  important  problem  will  be 
discussed  in  another  paper. 

2.  APPLICATION  OF  THL  HLTHODC 

l.i  order  to  illustrate  these  general  methods,  we  will  describe  their  applica- 
tion to  a radioaltimeter.  This  type  of  equipment  is  a good  example  because,  on  the 
one  hand,  its  reliability  is  excellent  (KTBF  over  2000  hours)  and,  on  the  other, 
it  is  suited  fc " a cost-efficiency  analysis  ; as  a matter  of  fact,  not  only  can 
the  cost  of  reliability  promotion  not  be  uisregarded  in  the  calculation  of  the 
overall  coot,  but  also  an  actual  reliability  "follow-up"  has  been  set  up  at  all 
thi.  development,  and  production  stages,  which  constitutes  a considerable  sourer  of 
Information  as  well  as  the  means  of  assessing  the  efficiency  of  these  methods,  as 
v/ill  be  seen  further  on.  The  application  of  these  methods  to  other  material,  in 
particular  to  IFF  airborne  transponders,  will  also  be  described,  for  thi  sake  of 
illustration. 

2.1.  Description  of  the  equipment 

The  reference  equipment  is  the  transmitting-receivirg  unit  of  a radio- 

-altlmeter. 

This  unit  consists  essentially  of  a solid-state,  hyperfrequency, 
frequency-modulated  generator  (21  module),  a homodyne  receiver  22  associated  with 
an  amplifier  23  actuating  a discriminator  Z7.  After  identifying  the  signal  received 
by  an  acquisition-tracking  logic  lodule  (26),  the  discriminator  signal  actuates 
the  modulator  25  (therefore,  closed-loop  operation).  Modules  Zk  and  28  transform 
the  internal  signals  inti  usaule  altitude  signals  ar.d  the  supply  unit  29  provides 
the  overall  cystrm  with  the  appropriate  voltages.  The  complexity  of  the  system  can 
be  defined  by  the  following  figures  : 600  components,  out  of  which  70  are  transis- 
tors, 30  linear  integrated  circuits  and  5 logic  integrated  circuits. 

2.2.  Reliability  Frediction 

Two  methods  were  us.ed  for  reliability  prediction. 

At  the  development  stage,  the  maximum-minimum  method  described  in  document 
HDEK  2 '7  A was  used  to  predict  a range  of  KTBF  values  while  the  study  was  still 
goin0  on. 

Once  the  final  patterns  have  been  selected,  a second  evaluation  vas 
coiried  out  on  the  basis  of  thi  data  provided  by  iiADC  68.  For  this  purpose,  a stress 
analysis  was  performed  for  each  component  in  order  to  make  sure  that  the  danger 
limits  of  use  of  these  components  had  not  been  reached. 

This  second  set  of  calculations  revealed  a 30  l.  increase  in  the  KTBF  over 
th  first  evaluation,  and  a different  distribution  of  the  percentages  of  influence 
of  th>  various  types  of  components,  bringing  out  the  proninrnt  part  played  by 
solid-state  component  and  integrattd  circuits  (70  $,)  in  the  failure  rate. 

As  indicated  in  table  2,  the  calculations  also  showed  the  distribution 
of  reliability  by  modulo. 
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2.3.  Selection  of  Conpomnts 

finer  reliability  prediction  calculations  pointed  out  the  lir.ro:  tin:  e of 

solid-state  component:',  ana  expe-Unee.  demonstrate  d that  diode's  ■<:  • • Lpnt:  illy  j;  ood, 

a particular  effort  was  devoted  to  transistors  and  integrated  circuits.  Th  se  vert 
purchased  following  specific  selection  pro;  ra  .ru  carried  out  by  the-  canuf  ritur  et  s 
chare  report.:  1 eveal  a rejection  ret*  v.ryinj  considerably  frer,  or.e  bitch  to  th< 
nc*:t.  The  average  percent  rye  is  23  of  r<  jeets  in  selection  te  sts,  "1th  extreme 
value  r r.;nyinfc  free.  ; to  70  , . 

Apert  from  solid-state  components,  chemical  r.aprci.'  . c and  clcctro- 
.v.a^ni  tic  relays  were  car' fully  studied  for  ti.eti  rc Halil  1 ty . The ce  t"o  typer  of 

components  we : e also  a0cd  aitiflcially  with  voltaic  applied.  In  the  case  of  chemical 

capacitors,  for  example , the-  selection  criterion  was  the  leakage  eurr.nt  after 
a _ein(_,  ; in  that  of  relays,  tlu  criterion  was  correct  operation. 

As  to  the  other  component.,  whose-  influence  on  reliability  is  less  impor- 
tant, as  shows  by  the  reliability  prediction  analysis,  they  were  acquired  according 
to  !i~t.s  ap.ircvt.tl  by  the-  military  administrative  services  and  by  the  eove'nmental 
quality  control  ovqanirahians, 

2. A.  Burn-In 

2.A.I.  .ir.dioaltineter 

F*'*'  this  raaioaltimeti  r , burn-in  operations  wore  sonduct'.d  err  three 
level-,  : 

a.)  Aft<  r the  vlrinj  csaenblinj  phase,  two  modules  are  submitt'd 
to  thermal  cycle  apelns  for  approximately  ICO  hoivs. 

One  of  the  nodules,  a hyperft  t quenev  yenerator  ft,  :riust  be 
stabilised  while  charged  prior  tr  in'l  adjustment  ; such  sta- 
bilisation plays  an  important  part  In  the  burn-ln  phase  when 
it  eliminates  faulty  UHF  transistors,  end  some  ceramic  copacl- 
tors. 

The  supply  module,  Z'),  his  to  be  burnt-in  separately  and  prior’ 
to  beiny  coated  with  varnish,  in  view  of  its  hi£h  l e j< ction 
: ate. 

bi  r'oliowtn_,  ass ‘mblinj  and  adjustment,  the  complete  packs  are 
subjected  to  thermal  cycla  (-  A0°J  ♦ 70°C)  butn-in  with  rst*.  i 
v .taye  and  vlbrat'ons  applied,  for  approximately  100  hours, 
c)  Finally,  the  equipment  is  submitted  to  brtukiny-in  for  2C0  hours, 
in  the  laboratory. 

2. A. 2.  A burn-in  test  was  conducted  more  recently  »n  an  airborne  IFF 
transponder. 

Tve  purpose  of  t.V  study  in;  to  carry  out  tests  to  determine  the 
duration  of  the  burn-in  operation  mcrr.sary  to  ensure  optimum 
opera tionsl  reliability  from  the  very  initial  stajc  of  operation 
of  the  equipment. 

The  following  method  vas  applied  : 

2A  devices  wire  campled  from  the  mass-produced  items  and  sub- 
mitted to  tests  cCO  hours,  out  of  which  A 00  hours  'were  in 
operation. 

The  test  cyclt  vas  worked  out  on  tat  basis  of  the  reliability 
tests,  described  in  specifications  MIL  7b'’  A or-  COT  190  : that  is 
to  say,  a temperature  cycle  ranyin£  from  - io*C  to  ♦ 95CC,  and 
vibrations  ranyiny  from  0 to  1Q0  Hr,  .at  2£,  applied  for  ID  minute- 
in  every  hour'. 

As  far  as  equipment  tcstlny  is  concerned,  the  internal  t‘ —t  of 
the  transponder  which  •as  operated  < very  30  seconds  , war.  used, 
and  chocks  "■.re  made  telco  a day  ti  d.tect  tV  cvcntu:.1.  ptrfc:- 
mon:t  deyrado tion  of  the  main  fu : tlcno . 

An  index  sird  was  sa:  . To  iV.h  equipment. 

Lei  us  analy-e  th.’  rv  culls  obi... in*  J. 

Th.  overall  equips),  nt  ' went  Lhrou.j.  appro. dr.-  1/  >0,  0C0  hour  s 
of  operation,  and  these  tests  led  to  two  typ. : of  action  : 

a)  On  the  one  hand,  plotting  th'  failur.  rote  cur".'  at  a functlin 
of  time  made  it  possible  to  (table  3'  : 

- brln„  out  the  first  two  portion"  of  the  "both  tub  •curve”, 
typl.-al  of  eli-cfonic  o ;u'  pmentr. 

- estimate  the  l'T3r  prior  to  burn-in,  acc.n'dlny  to  the 
■■:ell-known  rule:,  of  the  confidence  Interval  laws.  The 
values  obtained  cor  responded  to  the  e arly  operation  results. 

- dc,.e.  nln  . th<  burn-ir.  time  ra  ce  scary  to  rea-h  the  "bath  tub 
bottom".  As  tir.  curv.  was  .li.irly  Chirac  tv : Istt  s.  It  appear- 
'd with  evidence  that  the  main  early  operation  defects  had 
been  eliminated  aftt.  100  hour;.. 

- estimate  tiro  ..TBF  after  burn-in.  It  is.  monstr  ate  d that 
the  initial  e.TBr  can  be  Increased  by  160%  throuyh  burn-in. 


\ 

\ 
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b)  On  the  oth<  r bond,  the  reduction  of  the  data  or,  the  various 
ty,K  j of  fal. me  revealed  • fe- 1 • «.  ik  points  In  the  lo- 
rn nt,  mainly  t'u.  malfunctioning  of  aeon:  nioal  elements  at 
lew  tcrpei  ature.a,  end  a few  types  of  defective  conoonrnte. 
i-’os.'ltlr  remedies  were  considered,  sor.e  of  then  extending 
as  fa:  as  th>-  complete  : enakln0  of  c>  rtal-  circuits.  A 
Very  substantial  improvement  of  the  KTBr  can  bt-  c-xpcctnl 
after  tn.  3,'jli'ation  of  tht  modifications  to  the  equips-  nt 
to  be  pi  oduced. 

The  techni-  >'  1 ssons  drawn  from  these  tests  suggest  the 
following  modifi.  atl --.ns  : reinforces  nt  of  to«  tall  1 -atlon 
In  connection  holer  for  double-sided  cii cults,  and  useful- 
ness of  selection  tests  for  a type  of  integrated  circuits. 
It  is  '.’o;  th  pot  in-;  that  the  cast  increase  of  the  compon*  ntr 
selected  from  integrated  circuit  producing  firm:  has  not 
boc-n  reflected  in  the  cost  of  the  equipment  ; it  ?ff-r  that 
it  was  counterbalanced  by  a reduction  in  tie  cost  of  the 
manufactui ing,  control  end  repair  of  circuit  cards  in  the 
production  process,  where  tht  number  of  failuies  was  very 
h 1 gh  prior  to  circuit  bum-in. 

Such  action  proved  to  be  very  efficient,  since  no  mitalli- 
ratior.  failure  occurred  during  the  testa,  and  the  relia- 
bility of  integrated  circuits  was  improved. 

£.5.  reliability  testing 

Reliability  tests  in  conformity  with  the  specifications  MIL  761  A or 
CCT  '90  are  conducted  fairly  often. 

A particular  application  of  these  reliability  tests  to  another  type  of 
ai  borne  lie  transponder  will  be  described. 

One  of  t. e purposes  of  tbes?  reliability  tests  was  to  improve  relia- 
bility as  well  as  to  jet  a better  knowledge  of  the  MTBF  under  actual  operating 
conditions.  Therefore,  in  order  to  approach  as  closely  as  possible  to  real  mecha- 
nical ,ind  thermal  conditions  (ref.  table  4),  it  was  necessary  to  effect  several 
adaptations  of  tke  test  cycles  describ’d  in  the  specifications  MIL  7u1  A. 

The  main  results  of  these  tests  at  tire  following  : 

- comparison  of  the  itTBrs  obtained  through  predictive  calculations  and 
reliability  teats,  under  actual  operating  conditions  : 

. through  calculations  (iiADC)  : 600  hours. 

. through  tests  : 470  hours. 

. under  actual  operating  conditions  : 660  hours. 

- additional  information  was  obtained  : 

. very  strong  influence  of  the  temperature  and  vibration  cycle 
variation  law. 

. determination  of  the  optimum  duration  of  the  bum-ln  phase  (30 
hours  in  this  particular  case). 

. sure  knowledge  of  the  equipment  behaviour,  which  provides  means 
of  negotiating  the  Guaranteed  Reliability  Law. 

Reliability  tests  conducted  in  laboratories  are  generally  regarded  by 
LT7A  as  very  valuable  ; at  the  prototype  and  pre-production  stages,  they  provide 
the  means  of  detecting  reliability  "errors"  ; at  the  mass-production  stage,  they 
give  a good  approximation  to  the  operational  MTBF,  which  permits  improved  main- 
tenance (calculation  of  replacements)  and  provides  indispensable  information  for 
the  introduction  of  a guaranteed  reliability  clause  into  a contract. 

3.  LFFLCTIVLNECC  OF  MLTHGDG 

3.1.  General 

A a stated  in  the  above  chapter,  achieving  good  reliability  requires  the 
application  of  methods  at  all  levels  : at  the  equipment  design  stage,  in  the 
selection  of  components, in  the  manufacturing  methods  chosen,  as  well  as  during 
tests  of  all  types  or  when  drawing  up  and  applying  a quality  control  policy  ; 
therefore,  each  phase  in  the  life  of  an  electronic  equipment  provides  opportunities 
for  improving  reliability  through  specification.  To  each  action  corresponds  an 
accessible  cost  which  the  analytic  accounting  of  the  equipment  manufacturing  firm 
makes  it  possible  to  know,  but,  most  of  the  time,  it  proves  impossible  to  associate 
also  each  action  with  a given  level  of  effectiveness. 


io:o 


This  1 ilu  'o  th*-  pr  nbiM  1 1 r.t  ic  nutui*  of  reliability  - of  r-  qu>ntlti*r. 

( KT  BF  , fslluie  rat*)  - which  Oiiki  r It  difficult  to  mcisuic  and  to  till-  ;.ho:  t:  i/  of 
analytical  methods  of  a *,•  nr -a nutui c. 

A specific  study  was  uni*  rtaki-n,  Its  purpose  ,ms  to  d<  » ive-  frr-a  rial 
data  quantitative  relations  between  the  i* liability  l-rpi  ov«  ru  nt  o an  i 1 retro. .1 . 
equipment  anl  the  corresponding  cost  Inc  r ms*.  , Tn»::*  i » latlcnr  • to  ***  t<  rmit.* 
the  "cost-ef  f ectlvcnesa" , so  to  speak,  of  the  various  means  whl_h  can  bt  ir.,‘ It  mint- 
ed In  the  development  of  an  electronic  e;ul;>mtnt,  to  Improve  r i liability  ; thtrelire 
these  relations  make  it  possible  to  ch-nr*  tin  rii.nt  wti  l.t.  t>  _,!•«  t > • . c;\  of 
these  rat  ins  in  order  to  riach  a s* t r*  liability  ooj.  ;tlv*  is  economically  ar 
possible.  To  give  a concrete  rh  ifacter  to  ♦his  . tu  iy,  it  was,  up  > 1 i » 1 to  th-  rsd.-j- 
altimeter  already  mentioped. 

3.2.  Method  Analysis  Process 

kor  the  study  consid*  red  the  d at  i collect- :1  on  tiro  ra  liosltlmeter  pro- 
duction line,  which  produced  over  on.-  thousand  piec- c of  equipment  over  three  year-;, 
were  used  ; thus,  a considerable  amount  of  data  was  accumulated  : 

. data  on  failures  occurring  In  the  e,uipra-nt  or  one  of  Its  sub-units 
in  the  course  of  breakin0-in  t*s‘.s.  A-  a first  aporoximuticn,  we-  will 
admit  that  the  MTBF  resulting  from  this  c stir,  .t ion  provides  a suffi- 
ciently accurate  idea  of  the  openticnal  reliability  of  the  equipment, 
as  was  verified  through  other  means. 

. lde'ntlf icatlon  data  on  all  the  opernt.i  ,mr.  serr  ied  out  on  the  production 
line  since  its  inception  (supplies,  test-,  control,  etc.). 

All  the  information  available  on  3000  op- rations  was  record* d on  a data 
file  including  approximately  20,  COO  blocks  of  ou  ch  iruct*  r s. 

In  order  to  appreciate  the  effesti"en- ss  of  reliability  improvement 
methods,  all  the  resources  provided  by  statistical  -nd  fastorlil  analysis  vere 
resorted  to. 

Besides,  the  analysis  of  the  effectiveness  of  reliability  improvement 
operations  was  considerably  facilitated  by  the  qu.lity  of  . i-pairr  at  each  stage  : 
it  is  demonstrated  by  & first  analysis  that  these  oprr-t’onu  do  not  affect  ma.kii)/ 
the  subsequent  life  of  the  equipment  and,  therefore,  that  : eliability  impr  ovc-.v  nt 
processes  are  followed  by  independent  conscqui n?e o as  regards  a given  equlnment. 

3.3.  Critical  review  of  methods 

The  various  actions  described  previously  lead  to  a critical  review  at 
all  levels  ; 

Critical  review  of  the  nar.ufacturin,-  •w-ord  and  of  reMibllltv  nr-edictlon 

F.rst,  reliability  predictions  cun  be  cc  trolled. 

Bolld-state  components  play  an  essential  part  in  the  long  ron^t  relia- 
bility of  the  equipment  ! however,  intent  at* d circuit:,  also  play  a leading  role, 
especially  as,  in  tills  case,  the  reliability  selection  method  is  not  very  effective. 

The  distribution  of  failures  Is  in  rather  good  agreement  with  the  pre- 
dictions : as  a matter  of  fact,  modules  21,  ^6  and  29  are  the  mist  uelicate,  but, 
whereas  the  failures  of  21  ar.d  2t  do  not  affect  lone-term  reliability,  a high 
failure  rate  of  the  power  diodes  in  the  supply  nodule  is  the  certain  sign  of 
probable  fatigue  and  weakness  in  the  near  future. 

Critical  review  of  componrrt  selection  n-thods 

As  far  as  chemical  c-apacitoi  s arc*  concerned,  ageing  with  monitoring  of 
the  leakage  current  proved  efficient,  especially  as  the  long  rest  pe-'iod  which 
followed  this  agoing  phase,  prior  to  assembling  end  re-applpin,;  voltage,  allowed 
many  dubious  elements  to  continue  tneir  evolution  and  to  be  eliminated,  for  this 
type  of  component,  the  act. on  of  ageing  eyries  is  now  veil-known  and  a similar, 
but  faster  node  of  nelcctior  can  be  contemplated. 

As  regards  integrated  circuits  and  field  effect  transistors,  the  selec- 
tion method  proved  rather  inel 'ectlve. 

The  batches  which  the  manufacturer  indicates  or  offering  a higher 
rejection  rate  than  the  average  curing  reliability  imp-ovenent  tests,  also  offer 
a higher  raorfility  rate  during  the  subsequent  operations  and  under  actual  out-rat- 
ing conditions.  The  reinforcement  of  reliability  improvement  tests  and  checks 
resulted,  during  these  tests,  in  a higher  rejection  rate,  although  this  wav  follow- 
ed by  ro  subsequent  effect. 

However,  this  selection  may  have  had  a bercficlal  impact  : due  to  the 
considerable  number  of  rejects  in  the  course  of  reliability  lnpr<  verurt.  testinjP 
as  well  as  to  repeated  complaints,  the  manufacturer  delivered  batches  of  a markedly 
better  quality  around  the  end  of  the  production  period. 
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Aj  re0ir;l:  bipolar  trunr-  Is  tor  - , our  tit  1 rtl  .el  analytic  uses  not  'nolle 
ur  t ; draw  cu.y  con  lurions  : in  operition,  .c  'veil  ..s  in  the  '.our„'  of  nanufc  :t- 
ur‘:.„  ;'h.»  ■*  , th*  :aiu  * rolr  remains  It-  ai.d  £••*  *23  to  rhow  ..  thorou  ^hly  random 
character. 


Critic  i1  r - >’  l ■ lurn-ln 


. t.u'n-in  was  carried  out  on  e..o 

,.iolu!  f.r.  . - 

; 

■f'.;'  i m 

i a to:  ) .rri  i'j 

(.  up,  1;  '.  It  l.,  aho'-n  by.  nr.ulpr.es  that  : 

Vh*  ;■>.  two  module.'  b.ii.'V!  quit" 

tli  m .nt1.  y 

: 

, : * . ♦ i.  r* 

bu.  n-in  r ■ > -r; 

- ~.h  ceil,  an  wodul*.  ZV,  th*  r»  rult  do.  . aoi.  c 

» .t  ...  t>)  \)‘. 

co: 

iViiii.in 

r.r,  ,\u.  dr 

nodule  al'hou  h a tin,  of  the  nodule  it! 

a. 

,i  ; , 

v!  I'  :it 

rvluteiv 

I,-.,  . r ary  b:  go.  * tin  final  adjust  .<  nt  . • -2  . aunt e .net  the  often  dictr-actH 

••.!!•  .>  ; 5 .n  of  tr.n.  iotor  r;,ar;.c:i  ; ist'.r. . 


. ■ cgar.lr  the  bum- In  of  complete  units,  we  r.o.e  that  ulr.ort  half 

tr  f.  ilur-  s i:cui  lsi0  U;r  in«  -1-  f'r'-  f e.  Vo  .rs  cc:  re and  to  ".anuTactu:  ir»,  fault? 

L:'.  , It.  thir  , an  e.v  .pi  <.  ’.*  1 y <11  -..hr  t<  .1 . wit;-,  .out  .'either  ron.-.e  tu : nci  c . 3 

*..!  on  chic,  n car.  r or.-',  ud*'  iho  , t:.<  a 1 .t  10  hour?  of  lu:r.-in  tr  suited  in  a 
-0  , eduction  a.'  to-  g.  •.  n.»tu:  • defectr  repealed  in  operation  : the ••  e l'o:  e , truce 

fi.  rt  - 0 ho  a.  s do  nlay  the  burn-in  rol.  rx  .cctrd  frori  the  test. 

Th<  other  d<  f*  its  d<-*<  : < j duiir.  there  Initial  hours,  of  turn-in  are 

of  the  sane  type  as  those  detested  later  on  during  the  test.  The  role  of  burn-in 

ic.  i.o t evii.nt,  eept  .or  cii..  •. n*-.c,  chemical  eap_ci  t arc  sub  power  supply 

ivctifiir  dioier. 

A.  far  as  inu^ralui  circuits  and  field  effect  tr.  r.sisto:  r.  c.’c 
concerned,  the-  failure-  rate  during  the  te-t  provides  .n  Indies -.ion  of  the  quality 
of  the-  bat  h. 

It  remains  to  d‘ aw  tonclu ~ ions  on  -hr  overall  effect  of  the  test  : 
have  mo-t  failures  ■ l.i.li  would  have  if.  r,  place  in  the  cu.  Ig  or  1 te  sta0€  of 
operation  Sam  eliminated  by  tni-  U-t  V If  we  _nc  lyze  Uu  various  acp'cts,  we  can 
state  that  tr..,  ef  frstivein  rr  of  the  bum-in  operation  is  unquiet. enable , but  that, 
ac  a corollary,  failures  unrelit*d  to  rd. ability  art  induc'd  '.’hen  the  burn-in 
is  tco  roUjh,  r speci-lly  if  it  < r prclon„id  b- , or.d  10  hour;,. 

C.lticu'1  revirw  of  tin  industrial  t * 1 1 cbi  1 i t ••  . • . wl • t in,,  process 

'i’wo  ntin  ftedbrr.k  loop.-  We  •>  cup  posed  to  give  oosie  .stability  to  the 
.,u«lity  and  ; . Li  .bility  of  lie  finish.*  l pr  oduct  i on  wa..  ban  <1  on  the  qu-ilinctry 
of  il.t  in  usi.ial  .-.out:  ol,  and  the-  other  on  thi  at aouren*. nt  of  '.lit  i\Z3i'  durinu 
burn-in  ; .r  on  vi:  o"c rail  system.  ghe  analysis  of  thi:  process  revealed  that 

thi  l.iir.i  r function  o.  th-  feedback  loops  was  in  pproprt etc , in  particular 
b.  or.  us*  of  it.:  tine  con? tint. 

Ac  a aatt.r  of  iact,  an  industrial  chi  cl:  whose  effects  are  felt  too 
1 or. ^ after  ti.t  pro  iuctian  is  in*  f f c 1 1 v;  if,  in  the  ir.tf’val  of  tine  betwee-n  the 
,1 : i "Lion  of  i.a.  early  drfirt,,  tin  dt  ti  ruination  of  tlv  i:  caure  a (dtfcctivr 
inrtru.n  .nt.it' on,  innih  qujt-  rtuff)  mi  -he  i crr.edy , :..any  equipnmts  continue  to  be 
of.,  ctea  ay  eir*  cane  .auric . 

-,.i  :en.ai\i..  the  reliability  loop  bused  on  the  results  obtained  durint 
the  burn-in  phase,  its  rho-t  or  lor;,  term  regulating  effect  is  non  existent  since 
the  failure  : ate  at  this  1->".1  tr.  not  ■ epi  i si  ntative  of  the  naterial  reliability. 


3.u.  3rd!  down  of  ..eliability  Inprovenent  Cost 

Ihc  prtuiun  co  be  p id  for  th«  pi'oduction  of  a highly  reliable  radio- 
_ltir,  t r,  : in  Ui-  initial  v.anufactur  jnw  pr  do*  was  approx  ins  ti  ly  JO  ;■  of  tile 
rt  a.  e ,uip:r>. nt  ; .!.<  os.  of  coupon-. nt  selecticn  amount c d to  ,.  jf  this 
ru".,  wall  _r,  the  ;ost  of  hu.  n-in  and  clucking  operations. 

. a'  ;irv  :.  hi  of  illu-  iw.tio.i,  "c  .an  draw  up  a table-  of  thr  cos t- 

* ff  i c i * n-ry  . ,..io  of  . liability  imp:  ov.. merit  operations  for  actio  semiconductors' 

f.ilu  r.ti  i-  hiwh  in  relation  to  the  overall  failure  rate  of  the  quipnent. 
7’-'  .le  rctivi  :.a  f ,.n..u . tors  arc  involved  in  two  failures  out  of  three. 

Cn  vi  :■■■,.■  , the  jp.iroxin.i  .ion  formula  of  the  extra  premium  . which  we 

p.r'.d  tc  trie  ..up.il'.cr  for  tin  .election  operations  can  be  rritttn  as  follows  : 


c::  - 1 l * ?/  3 

I).-  i ffi.-i.ncy  an.'lysir  suggested  a means  of  r?  during  appreciably  the 
" <lf  i!>* 1 1 1'  " bu.l_ft,  and,  piolvibly,  of  limiting  it  to  an  ertia  y.niia  of  th-. 
o*  •!•'.  of  iw  . a matte  r of  fa-  t,f  i»,<  analyr-ir.  r-  veals  trirt,  in  .-.pit*-  of  all 

w.  e cautions,  tie.  •liability  of  th*  . pppnrn’t  i«  nr.  ins  a direct  function  of  th* 
qu.litr/  of  ti.  ..».:*  parts. 

7'  a v..  !u*  •.  t*  a f al  ’ owed  in  order  to  nshi.-Ve  t ..  best  porribli 
•lost-rel l - b( 1 1 tv  .rade-aff  would  be  the  following  : 
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- even  if  tl.e  real  ir'ictlwiu  js  • the  component  selectl'in  operations 
is  low,  that  Is  to  say  If  "Loou"  and  "bac!"  components  art*  eliminated 

ill  equal  numbers,  all  the  operations  which  were  carried  out  are  Justlfi 
ed  (for  instance,  in  the  case  o'-  tranr.l  tors  and  integrated  circuits, 
over  to  ‘,j  of  the  rvjtcts  would  have  to  be  '-injustlf  led  for  the  method 
to  lose  its  interest). 

- the  burn-in  of  module  29  could  have  been  replaced,  with  financial 
advantage,  by  this  selection  of  power  diodes  at  the  component  3tagc. 

- the  failure  rate  of  the  comp  on*  nt s with  voltage  applied  should  be  re- 
tained as  a criterion  on  which  to  base  the  decision  for  increasing, 
or,  on  the  contrary,  reducin0,  ‘.he  strictness  of  the  selection  operat- 
ions "upstream". 

- an  overall  burn-in  of  ^0  r.ou.  s duatlan  is-efficient  : most  defects 
detected  at  th.t  stage  would  have  brought  about  failures  In  an  early 
operation  phase. 

- on  the  other  hind,  it  ' s not  useful  to  prolong  the  tum-ln  phase,  as 
besides  failures  probably  related  to  initial  defects,  this  repeals 
too  many  artificial  .'allures  for  the  method  to  be  warrantable  in 
general. 

••  b: eaking-ln  on  the  test  bench,  without  any  cliaat’c  stresses,  i- 
valuable  insofar  as  it  gives  a good  idea  of  operational  reliability  ; 
however,  all  types  of  equipment  should  not  be  systematically  submitted 
to  such  testing,  unless  the  KfBF  of  a cample  is  markedly  lower  than 
the  KTBv  set  as  an  objective. 

- finally,  and  above  all,  a constant  hijn  reliability  policy,  for  this 
material,  yl'  ldc  e:.  •vllent  long  term  result  , at  no  cost  ; it  has  led 
to  the  produrtion  of  better  quality  and  higher  reliability  parts  by 
component  su.>.  lit  re. 


4.  CCKCli'e’.IO.t 

Fror.i  t’.'.e  overall  work  described  in  t).i-:  paper,  and  in  particular  from  the 
"cost-off irie.icy"  study  ronduett  d on  -cl lability  methods  as  applied  to  a 
radto-rl  ttr.i  to.  , an  can  draw  a few  simple  'on'lusion ' . 

The  :.voct  crrentl.il  conclusion  ir  or-'  of  common  s»  n«e  (md  tills  is  not 
ii t appointing  inasmuch  «;•.  common  sense  i.  not  cvldint)  : "high  reliability" 
annet  be  reni-ved  with  artificial  mans  ; "_ood  components"  and  a "clean 
Job"  for  ua..»  r.bl  ing  them  are  required.  As  a matter-  of  fact,  attempting  to 
romp  nsat*  a defective  production  including  faulty  components  by  bum-in 
t-  .-t-  .'oul  i b>-  error-  our-. 

..not  . r mo:  t imp'it  .nt  onclusion  can  be  -an  : to  apply  these  simple  methods 
ani  (non  thet:  effectives  ss,  measurer  must  be  taken  n’t  all  the  stages  of 
t'v  i ; lipn-.nt  life  : ji-vi’o  >o.nt  and  u x cf  gO.-J  cor.  on-  nt" , d*  tailed  project 
• r.alvcts  by  m ine  of  reliability  pudirtion  c;*l  .ulationr,  'artful  aanufactu-- 
tng,  ccntrollcd  and  complemented  by  Judiciously  selicted  bum-lr.  and  relia- 
bility testing  ar,  iewa;iio  both  service  life  and  stressed. 


This  Li  is  partly  based  on  work  pc»f~ 
1*.  .ii  .........  ...  ! o',  c ....  i . ur.lt  c -lit. 
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ABSTRACT! 


A survey  of  the  envl-  onmental , physical  and  electrical  tests,  which  are  necessary 
to  establlsn  the  reliability  of  electronic  parts,  is  given.  Special  accent  is  placed 
on  the  testing  of  semiconductors.  All  the  tests  are  described  together  with  the  failure 
they  can  detect  in  parts.  Within  these  three  categories  of  tests,  nondestructive  and 
destructive  ones  are  distinguished.  Although  most  popular  tests  are  mentioned,  special 
emphasis  is  placed  on  tests  not  so  widely  used  yet,  such  as  high  stress  tests,  accousti- 
cal  particle  detection,  thermal  mapping  by  means  of  liquid  crystals  and  the  test  of  in- 
put protection  circuits  of  MOS  IC's.  The  need  for  visual  inspection  as  a means  of  im- 
proving the  quality  of  components  is  discussed.  Product  analysis  as  a means  of  evaluation 
of  the  parts  manufacturers  capability  is  described  in  detail. 


1 . INTRODUCTION 

The  purpose  of  testing  is  to  determine  the 
compatibility 

of  materials  within  the  component 

- of  circuit  parameters 

- of  components  with  processes  of  the  user 

of  components  with  the  anticipated  environments  [l3 

The  properties  of  materials  must  be  tested  by  mechanical,  chemical,  electrical 
and  thermal  methods.  It  is  most  important  that  the  test  methods  deliver  reproducible 
test  results.  Therefore  all  the  tests  should  be  performed  to  well  established  standards. 
Besides,  the  environmental  conditions  for  the  tests  must  ^e  given,  for  instance  relative 
humidity  for  resistance  measurements  or  atmospheric  pressure  for  dieelectric  breakdown 
measurements.  The  basic  parts  of  a test  are 

- the  test  conditions 

the  respc  -e  during  the  test 

- the  measurements  after  the  test 

During  the  testu  the  processes  may  be  reversible  or  non-reversible.  The  most  important 
non-reversible  process  is  aging. 

Since  it  is  not  possible  to  predict  a definite  parameter,  it  is  necessary  to  give 
confidence  levels  with  which  a certain  percentage  of  measured  parameters  will  fall  in 
a defini  ,e  category.  All  tests  c«n  be  distinguished  into  two  major  groups,  which  are 
used  to  determine  the  quality  of  electronic  components,  namely  nondestructive  and 
destructive  tests.  Within  these  groups  again  one  can  separate  environmen  >1,  physical 
and  electrical  tests.  The  following  presentation  is  going  to  follow  this  general  outline. 
Because  of  the  Importance  o i these  two  categories,  however,  two  separate  paragraphs  are 
dedicated  to  life  testing  of  electronic  par  s and  the  constructional  analysis  of  techno- 
logies. 


n-i 

1.1.  LIFE  TESTING  OF  ELECTRONIC  PARTS 


Lifetime  testing  of  electronic  parts  is  performed  at  constant  temperature.  Tests 
are  made  at  high  temperature  to  get  acceleration  of  failure  mechanisms.  In  addition  to 
high  temperature  electrical  stress,  such  as  voltage  or  current,  is  also  used,  which 
further  enhances  the  sooner  occurence  of  failures.  One  can  thus  usually  distinguish  two 
Kinds  of  lifetime  tests 


- storage  life  time 

- operating  life  time  (elevated  temperature  plus 

voltage,  current,  power  stress) 

A very  effective  test  is  the  high  temperature  reverse-bias  test.  The  result  of 
lifetime  measurements  are  usually  given  as  mean  time  to  failure  in  hours  or  as  failure 
rate  in  »/1000  h for  a certain  confidence  level.  Table  I gives  for  example  the  results 
of  lifetime  tests  for  C-MOS  integrated  circuits  of  several  manufacturers  [3,  . 

Table  I:  Tallure  Rates  of  C-MOS  Circuits  o*  Several  Manufacturers 
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Most  Important  in  lifetime  test  comparisons  is  that  the  tests  should  be  conducted  for 
the  same  amount  of  device  hours.  In  calculations  one  failure  after  the  test-time  has  to 
be  assumed,  so  even  for  zero  failures  at  that  time  the  failure  rate  is  high.  The  more 
device  hours  there  are,  the  better  the  actual  failure  rate  can  be  determined.  In  table  I 
also  some  acceleration  factors  are  given  by  means  of  which  the  equivalent  of  55  °C 
failure  rate  can  be  calculated  w-  This  is  also  indicated  by  the  number  of  failures  vs. 
time  curve  of  Fig.  1. 


Fig.  Is  "Bathtub"  Curve  of 
Failures  vs.  Time 


Only  in  the  flat  part  of  the  curve  a component  should  be  operated.  Burn-in  should 
eliminate  the  parts  during  the  high  mortality  range. 


1.2.  ENVIRONMENTAL  TESTS 


Ml 


In  all  the  environmental  test*  the  stiess  applied  la  ao  hlqh,  auch  aa  not  to  weaken 
good  Jevlcci  but  to  ahow  weak  devlcea.  The  atreaaea  that  must  ba  applied  to  comi-onenta 
to  detect  failures  are  however  much  higher  than  those  that  can  be  uaed  on  an  equipment 
level.  So  unleaa  the  testing  of  the  components  has  been  done  before  assembly,  there 
mostly  is  no  way  to  test  for  weak  devlcea  after  assembly. 


1.2.1.  THERMAL  TESTS 

There  are  three  types  of  thermal  testa 

- tea’s  at  constant  temperature 

- thermal  cycles 

- thermal  shock 


1.2. 1.1.  TESTS  AT  CONSTANT  TEMPERATURE 

The  electrical  parameters  of  electronic  parts  stabilise  after  storage  for  some  time 
at  high  temperatures.  This  process  is  called  burn-in.  Sometimes  this  test  is  combined 
with  voltage  or  power  stress.  Burn-in  tests  are  useful  for  determining 

paramter  drift  failures  in  both  active  and  passive  devices 
inversion  and  channelling  in  semiconductors 
IC  metalization  defects  (scratches,  discontinuities  at 

steps  in  oxide) 

- pinholes  in  the  oxide 

- contamination  (moisture  and  other) 

Because  of  the  stabilizing  effect  of  high  temperature,  these  thermal  tests  at  constant 
temperature  are  performed  before  mechanical  and  other  thermal  tests.  Lifetime  measure- 
ments are  also  performed  at  constant  temperature  as  indicated  above. 


1.2. 1.2.  THERMAL  CYCLES  AND  THERMAL  SHOCK 

During  temperature  cycle  and  temperature  shock  tests  the  temperature  of  an  electro- 
nic component  is  chanqed  between  temperature  extremes.  With  thermal  cycles  the  temperature 
change  is  performed  slowly,  whereas  with  thermal  sho  k the  temperature  of  the  components 
is  changed  rapidly,  mostly  by  means  of  transfer  between  liquids  which  are  held  at  tempera- 
ture extremes.  The  maximum  and  minimum  temperatures  are  chosen  so  that  they  have  no 
degradation  of  good  IC's  as  a consequence.  The  changes  in  parameters  and  the  failures 
produced  during  temperature  cycling  are  caused  primarily  by  differences  in  thermal 
expansion  coefficients  and  by  evaporation,  condensation  and  freezing  of  moisture  or 
other  contaminants  inside  the  package. 

Thermal  shock  is  a much  more  severe  test  thar.  thermal  cycles.  The  changes  in 
characterlstlca  and  the  damage  during  thermal  shock  are  a consequence  of  the  rapid  change 
in  dimensions. 


These  thermal  tests  serve  to  show  the  following  failures: 


• cracking  of  embedding  and  encapaulating  components 

- rupture  of  conductors  or  insulators 

- weak  lead  bonds 

- package  defects 

- metalization  defects 

- incompatibility  of  coefficients  of  thermal  expansion 

- bad  chip  bonds 

Table  XI  gives  the  results  of  environmental  tests  on  C-MOS  devices  based  on  the  manu- 
facturers information  [3,  4,  5,  6]  . 

Table  III  Environmental  Tests  of  C-MOS  Circuits  of  Several  Manufacturers 


1.3. 1.3.  HIGH  STRESS  TESTS 

As  already  indicated  in  the  paragraph  on  tests  at  constant  temperature,  sometimes 
higher  stresses  are  used  to  come  as  soon  as  possible  to  information  concerning  the 
quality  of  an  electronic  component.  Stress  testa  have  already  been  very  important  in 
the  past,  but  will  gain  importance  with  LSI  testing,  because  the  number  of  components 
of  one  type  produced  may  not  be  as  high  as  with  conventional  devices.  Therefore  the 
statistics  of  lifetime  tests  are  not  as  good  also.  Stress  tests  also  serve  the  purpose 
of  determining  the  maximum  rating  of  a component  and  to  determine  the  safety  margins  j 
which  are  existing  at  specified  operating  conditions.  Stress  tests  of  different  lots 
can  very  fast  indicate  process  charges  which  can  influence  the  reliability  of  a component. 
Fig.  2 shows  a typical  example  of  this  w. 


number  of  cycles 
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The  stress  used  was  thermal  shock  by  alternate  Immersion  Into  liquid  baths  of  -b5  °C  and 
250  °C  (dwell  time  In  the  bath  90  s at  -65  °C  ♦ transfer  time  of  5 sec  ♦ dwell  time  In 
the  bath  at  250  C • 1 cycle) . One  can  clearly  see  that  more  recent  circuits  of  the  manu- 
facturer (code  69  17  means  17th  week  of  1969)  show  a much  sooner  failure  than  formerly 
produced  ones.  With  the  help  of  this  test  manufacturing  problems  can  be  detected  and  solved 
much  sooner  or  the  user  can  switch  to  another  manufacturer  if  he  detects  failures. 


1.2.2.  MECHANICAL  TESTS 

Mechanical  tes_-  = r--r'~rred  to  «haw  components  with  bad  mechanical  properties. 
Three  types  cf  stress  can  be  distinguished 

- vibration 

- constant  acceleration 

- mechanical  shock 

These  tests  are  performed  after  the  thermal  tests  to  detect  components  weakened  by 
these  tests. 


1.2. 2.1.  MECHANICAL  V' BRAT ION 


The  vibration  test  is  used  to  determine  the  effects  of  vibration  on  components  and 
It  is  very  Important  to  select  an  individual  vibration  level  that  la  suitable  for  each 
component.  Very  Important  is  the  determination  of  critical  resonant  frequencies.  Mostly 
the  vibration  met  in  the  application  is  not  of  a sine  nature,  but  records  of  actual 
vibration  may  be  used  to  copy  natural  avionic  or  rocket  environment.  In  monitored 
vibration  the  electrical  performance  is  checked  during  vibration,  for  Instance  for 
shorts  due  t foreign  particles  in  the  component. 


1.2. 2. 2.  MECHANICAL  SHOCK 

A short  pulse  of  high  acceleration  (up  to  50  OOO  g)  is  used  to  test  the  response 
of  devices  to  severe  shocks  as  a consequence  of  drops  or  abrupt  changes  in  motion 
produced  by  rough  handling  or  transportation.  This  test  is  cheap  and  in  IC’s  is  used 
to  detect  bad  lead  dressing,  bonds  and  package  defects. 


1.2. 2. 3.  CONSTANT  ACCELERATION 

High  constant  acceleration  centrifuge  tests  up  to  40  OOO  g are  used  for  components 
(IC's)  to  detect  failures  in  contacts,  solders,  and  to  show  weak  bonds  (perhaps  due  to 
purple  plague)  and  bad  lead  dressing.  Fig.  3 shows  a bond  weakened  by  purple  plague  lifted 
after  acceleration  tests.  This  will  be  shown  in  more  detail  in  section  2.1.  (Figures  14,15). 
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t.l.  PHYSICAL  TESTS 
1.3.1.  LEAK  TESTS 

Leak  testa  ar«  made  to  test  the  hernetlcity  of  components.  Hermeticlty  la  importer  t 
to  keep  contaminants  out  of  the  component.  It  is  aj.ro  Important  because  it  can  give  an 
indication  of  the  amount  of  outgasslng  to  be  expected.  This  is,  however,  described  in 
more  detail  in  the  section  on  destructive  tests,  which  barometric  pressure  tests  can  be. 

-8  3 

Usually  packages  are  said  to  fall  if  the  leakage  rates  are  higher  than  10  cm  /sec. 
The  limited  range  of  measuring  of  each  teat  method  makes  the  use  of  different  methods 
necessary.  Gross  leaks  can  be  detected  by  means  of  the  penetrant  dyt.  test.  The  part  la 
immersed  in  a dye.  This  is  a destructive  test  because  the  part  has  to  be  cross-sectioned 
to  determine  where  the  dye  has  penetrated.  Mostly  used  for  gross  leak  tests  is  the  fluoro- 
carbon type  test  [8,  loj.  Fluorocarbons  cause  no  corrosion  or  contamination.  The  component 
is  immersed  into  a bath  of  fluorocarbon  at,  for  instance,  125  °C  and  under  a microscope 
of  small  magnification  one  looks  for  bubbles  comirg  from  the  component  with  a leak.  This 
method  can  show  leaks  up  to  10~3  cm  3/sec. 

A more  sophisticated  test  of  this  type  makes  use  of  two  types  of  fluorocarbons 
with  different  boiling  temperatures.  The  component  is  first  put  into  a pressure  chamber 
into  which  after  evacuating  a low  boiling  fluorocarbon  is  brought.  The  liquid  is  under 
high  pressure  and  penetrates  into  any  leaks.  The  component  is  then  immersed  into  a bath 
of  a higher  boiling  fluorocarbon  liquid.  Upon  heating,  first  the  low  boiling  liquid  in 
the  part  evaporates  and  the  gas  escapes  through  the  leak  which  is  Indicated  by  bubbles 
in  the  second  liquid.  This  test  shows  leaks  up  to  10-^  cm  3/sec. 

Fine  leaks  are  detected  by  means  of  the  Helium  leak  test  £ 9j . In  the  Helium  leak 
test  the  component  is  brought  into  a chamber  pressurized  by  Helium,  so  that  Halium  is 
pressed  into  a possible  leak.  Then  it  is  brought  into  the  vacuum  chamber  of  a mass 
spectrometer  which  detects  the  Helium  coming  out  of  a leak.  Leak  rates  of  lO-6  cm  3/sec 
to  10  10  cm  ^/sec  can  be  detected. 

With  the  radioisotope  fine  leak  test,  instead  of  the  Helium  a radioactive  gas  is  used. 
The  radioactive  gas  escaping  from  the  leak  can  then  be  detected.  The  test  is  effective  in 

.a  _ i 2 3 

a range  between  10  to  10  cm  /sec. 


1.3.2.  X-RAY  TESTS 

X-ray  tests  of  components  can  be  performed  in  a static  and  a dynamic  way.  An  X-ray 
photograph  of  the  component  can  be  taken  and  then  be  investigated  under  the  microscope. 
In  the  dynamic  mode  an  X-ray  TV  system  is  used  which  can  be  used  to  show  the  component 
as  it  is  moving  on  a vibration  table  and  thus  perhaps  show  a foreign  particle  moving 
inslcie  a relay  or  an  IC  can.  The  X-ray  metnod  is  not  very  effective  for  elements  as 
close  together  in  the  periodic  system  as  silicon  and  aluminium  but  can  be  readily 
applied  to  Au-Sl  systems.  The  X-ray  test  can  show 

- foreign  particles  in  the  component  or  the  case 

- bad  conductor  or  lead  dressing 

- relay  contacts 

- double  lead  bonds  or  voids  in  chlp-bcnds  of  IC’s 

- bad  positioning  of  elements  such  as  bonds  not  properly  placed 

- voids  in  encapsulants 

- open  leads  in  encapsulated  coils  or  transformers 


1.3.3 


ACCOUSTICAL  PARTICLE  DETECTION 
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A vibration  shaker  can  be  used  to  bounce  foreign  particles  around  in  the  package  of 
a component  auch  aa  a relay.  Loose  Particle  Detectors,  as  they  are  colled,  are  commercial- 
ly available  and  detect  particles  by  the  ultrasonic  emissions  produced  by  the  particles 
as  t:"y  bounce  around  in  the  vibrated  package.  A transducer  is  used  to  detect  the  ultra- 
son.  ' emission  and  after  amplification  the  signal  can  be  monitored  on  an  oscilloscope 
£11,  12j.  P.irtlc'es,  having  a mass  as  low  as  0,1  ^,ug,  can  be  detected.  The  detection 
efficiency,  however,  increases  with  increasing  size  of  the  particles.  For  frequencies 
ranging  from  20  - 3000  Hz  and  at  10  g's  the  dependence  of  detection  efficiency  on  particle 
size  is  given  in  table  III  £ 1 1 J : 

Table  IIIi  Dependence  of  Detection  Efficiency  of  Foreign  Particles  on  Particle  Size 


oartlcle  size 

% detected 

inch 

0,002 

40  1 

0,003 

85  t 

0,004 

100  t 

1.3.4.  THERMAL  KAPP INC 

In  most  of  the  cases  the  temperature*  of  components  have  to  be  determined  under 
actual  operating  conditions  to  determine  the  rating  of  the  part.  Thermocouples  can  be 
used  in  great  number  or  several  successive  tests  have  to  be  made.  Thermochrome  crayons, 
which  irreversibly  change  the  colour  at  a specific  temperature,  are  not  as  accurate  but 
can  in  nose  cases  of  thermal  design  be  used.  Stickers  are  also  available,  showing  the 
maximum  temperature  obtained.  Above  methods  have  lower  spatial  resolution  and  can  only 
be  used  for  bigger  parts.  The  Infrared  microscope  can  be  used  for  the  determination  of 
temperature  distributions  on  parts  or  within  IC’s  £l3j.  This  method  of  thermal  mapping 
is  very  effective  in  showing  hot  spots  due  to  manufacturing  or  packaging  fault*.  Like 
tne  following  method  it  can  be  performed  before  capping  tie  component. 

A new,  vety  cheap  and  effective  method  is  thermal  mapping  by  means  of  liquid  crystals. 
These  liquid  crystals  change  the  colour  according  to  the  temperature  of  the  component, 
they  are  coated  onto  in  a reproducible  way  if  observed  under  a fixed  angle.  The  back- 
ground has  to  be  blacked  as  any  light  reflected  there  serves  to  decrease  the  contrast. 

The  colour  change  is  reversible. 

Table  IV:  Characteristics  of  Some  Temperature  Measuring  Methods 


Temp*  Accuracy 

Spatial 

resolution 

Temp.  Range 

Cost 

Thermocouples 

u 

0 

6 

1 

mi  1 

<r  2000  °C 

*1 ,ooo 

Infrared 

0,5  °C 

0,5 

mil 

>10,000 

Liquid  Crystal* 

o 

o 

rj 

1 

ml  1 

-20  °C  to  *200  °C 

*i/g 

Table  IV  shows  the  thermal  and  spatial  resolution  of  several  temperature  measuring 
methods  compared  to  the  liquid  X-tal  mrthod.  The  method  is  very  well  suited  for  the  IC 
and  hybrid  technologies  and  even  P.C.  boards.  Fig.  4 shows  the  calibration  curve  of  a 
liquid  crystal  £l4j. 
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Fig . 4:  Dependence  of  Liquid 
Crystal  Colour  on 
Temperature 


Fig.  5,  show*  the  failure  rate  of  a resistor  versus  the  surface  temperature  [l  S]  and 
demonstrates  the  need  for  knowledge  of  the  temperature.  The  liquid  X-tal  method  by 
itself  is  not  a destructive  test,  but  of  course  in  an  IC  the  cleaning  process  can  be 
deteriorating  to  'ome  extent. 


Fig.  5s  Failure  Rate  of  Resistor 
as  a Function  of 
Surface  Temperature 


1.3.5.  VISUAL  TESTS 


The  optica’  microscope  can  be  used  before  capping  the  component  to  perform  precap 
visual  inspection.  Even  if  the  optical  microscope  is  not  as  good  with  respect  to  reso- 
lution and  depth  of  focus  as  the  SEM,  it  has  one  advantage,  namely  that  of  colour. 

The  colour  information  gives  a high  contra.. t between  different  parts  in  a component  and, 
for  Instance,  makes  possible  the  determination  of  the  thickness  and  homogeneity  of 
oxides.  The  failures  detectable  with  the  optical  microscope  include 

- foreign  particles 

- contamination  and  corrosion 

- coating  defects 

- package  and  lead  defects 

- metalization  defects  such  as  scratches, 
holes,  bridging  in  IC's 

- bad  lead  bonds,  double  bonds,  misplaced  or  cracked 
chips  and  wrong  mask  alignment  in  IC's 


i 


1 1-9 


If,  however,  one  wants  to  detect  discontinuities  in  metallaatlons  over  steps  In  the 
oxide  or  look  closer  at  bonds,  then  one  has  to  use  the  SEM.  Fig.  6 shows  a chip  where 
cracks  extend  into  the  active  regions  and  which  therefore  is  a reject.  Fig.  7 shows 
a case  where  visual  inspection  is  possible  even  with  packaged  devices.  This  picture 
shows  a Charge-Coup  led -Dev  ice  imago  sensor,  which  of  course  i.ss  to  have  a window  for 
the  focused  image.  Tig.  8 shows  the  CCD  device  with  the  maximum  magnification  possible 
due  to  the  low  working  distance  of  high  power  objectives. 


1.3.6.  SEM  TESTS 

Investigation  of  semiconductors  with  the  Scanning  Electron  Microscope  (SEM)  is 
before  packaging  suggested  as  a means  of  checking  the  metalization  of  mission  critical 
parts  [l6j.  This  however,  should  only  be  done  on  a sample  basis  because  testing  with  the 
SEM  can  be  a destructive  test  as  shown  b>  t.  ♦ G.  Ress  fl7j.  Radiation  damage  as  a result  of 
the  electron  bombardment  can  lead  to  threshold  voltage  shifts  in  MOS  transistorc.  The 
negative  rest  gas  ions  are  accelerated  towards  the  scanned  sample  and  cause  contamination 
of  the  sample  surface.  So  only  in  a limited  way  the  SEM  inspection  can  be  considered  as 
a nondestructive  test. 


1.4.  ELECTRICAL  TESTS 

The  field  of  electrical  tests  is  so  wide  that  it  cannot  be  covered  totally  in  a 
survey  like  this.  Therefore  I would  like  to  pick  out  just  a few  tests  for  illustration 
of  the  complex. 


1.4.1.  INSULA1 ION  RESISTANCE 

Even  if  the  insulation  resistance  of  capacitors,  p.c.  boards  is  very  high,  it  may 
be  the  limiting  factor  in  the  design  of  circuits  with  high  input  Impedance.  This  example 
shows  very  well  that  good  care  has  to  be  taken  to  define  the  conditions  of  a test.  For 
high  insulation  resistances  during  measurement  the  relative  humidity  of  the  atmosphere 
must  be  monitored  because  this  can  have  a drastic  influence  on  the  measured  value. 
Excessive  leakage  can  lead  to  heating  of  insulators  or  to  unwanted  DC  feedback  loops. 


1.4.2.  FUNCTIONAL  TESTS  OF  COMPONENTS 

Functional  tests  are  used  mostly  together  with  IC’s  to  determine  whether  the  circuit 
performs  a specified  function  as  a consequence  of  applied  input  patterns. 

The  logic  output  of  the  device  under  test  (DUT)  is  compared  either  with  the  output 
of  a reference  IC  or  to  a pattern  generated  in  a computer.  Only  the  sequence  of  "1"  or 
"0“  on  the  outputs  is  usually  compared,  but  absolute  measurements  of  the  DUT  levels  can 
be  made  by  comparing  the  outp'.t  amplitudes  to  voltages  set  by  means  of  adjustable  power 
supplies.  Functional  tests  are  also  the  checking  of  the  operation  of  a relay  or  switch. 
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1.4.3,  PARAMETRIC  TESTS  OF  COMPONENTS 

At  an  example  for  parametric  testa, those  of  IC'a  will  be  described  as  the  most  compli- 
cated type  of  parametric  testing.  Usually  the  parametric  testing  of  semiconductors  is 
performed  in  testers  having  the  capability  to  test  many  parameters  successively  by  the 
same  tester.  This  is  necessary  to  save  testing  time. 

For  failure  analysis  and  incoming  inspection  simple  manual  testers  are  mostly  used 
which  are  basically  go-no-go  testers  but  with  a capability  to  determine  a failed  parameter. 
The  average  tester  for  static  parameters  is  usually  much  cheaper  than  the  testers  of  dyna- 
mic characteristics.  So  in  that  field  specially  designed  separate  testers  are  quite  popular. 
One  problem  frequently  encountered  in  failure  analysis  tests  and  in  incoming  inspection  is 
that  of  the  great  variety  of  components  that  have  to  be  tested.  In  the  case  of  the  component 
manufacturer  the  high  volume  may  make  the  use  of  special  adapters  for  tester*  feasible,  but 
for  low  volume  testing  the  testers  should  be  easily  adaptable  to  other  part  types.  Best  of 
all  of  course,  is  a computer-operated  tester  which  also  allows  easy  data  logging  and  where 
only  the  software  has  to  be  changed.  But  the  high  price  of  these  instruments  is  again 
not  justified  for  low  volume  testing. 

The  details  of  which  parameters  have  to  be  checked  will  not  be  covered  here  because 
this  is  different  for  each  component.  Just  a few  problems  associated  with  the  testing  of 
higher  complexity  LSI  circuits  shall  follow. 

It  has  been  shown,  that  in  order  to  predict  later  failures,  the  method  of  pin-to-pin 
tests  is  most  effective  [18J.  There  are  no  problems  performing  these  pin-to-pin  tests  r— 

SSI  and  MSI  circuits.  But  with  LSI  circuits  a problem  exists.  For  a circuit  with  n . wuts 
the  maximum  amount  of  different  states  is  2n  (no  memories  or  counters  Inside  th'*  circuits). 
The  worst  case  for  2n  states  is  that  one  half  is  in  the  "0"  state  and  the  other  half  in 
the  *1*  state.  In  order  to  switch  each  "0*  state  to  *1*  and  each  “1*  to  a "0" 

2n/2  x 2n/2  x 2 ♦ 1 switching  cycles  are  necessary  to  arrive  at  the  initial  state.  For 

g 

a circuit  with  15  inputs  about  10  different  tests  would  be  necessary.  With  a time/test 
of  1 ^usec  the  total  testing  time  would  be  16,6  min.  So  with  LSI  circuits  only  a few 
meaningful  tests  can  be  performed  and  the  reliability  of  the  circuits  also  ensured  by 
performing  scrutinous  inspections  during  the  manufacturing  of  the  IC  and  by  doing  the 
constructional  analysis  of  the  technology  as  lateron  described. 


2.  DESTRUCTIVE  TESTS 

2.1.  EVALUATION  OF  THE  MANUFACTURER'S  CAPABILITY 

For  mission  critical  parts  it  is  very  important  that  the  quality  of  the  parts  be 
ascertained.  This  should  be  done  by  taking  samples  of  one  lot  and  performing  a quality 
analysis.  The  procedure  would  be  almost  the  same  as  for  failure  analysis;  specifications 
for  the  performance  of  failure  analysis  are  available  [l9j. 

First  of  all,  the  DC  and  AC  parameters  should  be  verified  before  and  after  additional 
environmental  tests  as  given  in  the  specification.  Decapping  should  then  be  done.  For 
reference  it  is  best  to  always  check  at  least  two  devices.  The  die  should  be  closely 
examined  with  an  optical  microscope  first  and  important  dimensions  determined  f20j. 

These  values  are  important  for  the  evaluation  of  the  reliability  and  reproducibility 
of  the  circuit  and  can  also  be  used  to  get  Information  on  the  industry  standard.  All 
the  possible  failures  described  above  can  be  detected  in  the  optical  microscope.  The 
general  outline  to  follow,  including  forms  to  be  used  for  the  evaluation  recc.dlng,  is 
given  by  L.  Hartley  [20J. 
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rig.  9 show*  a sample  of  a non-uniform  oalda  shown  by  a change  In  the  colour  of  the 
oxide.  Next  the  metalizatl''nof  the  device  should  be  checked  for  discontinuities  at  steps 
In  the  oxide,  rig.  10  shown  a contact  window  where  the  Aluminium  has  been  too  deeply 
alloyed  into  the  window,  rig.  11  shows  some  of  the  protective  phosphoslllcate  glass  mis- 
sing which  protects  the  Al-metallsatlon  and  this  might  be  due  to  too  much  etching  or 
contamination,  because  part  of  the  A1  at  the  bonding  pad  also  has  been  etched  away.  SCM 
pictures  also  can  show  the  control  the  manufacturer  has  on  his  bonds,  rig.  12  shows  a 
good  lead  bond.  rig.  13  on  the  contrary  shows  deep  pits  In  the  surface  of  the  bond,  the 
tool  was  worn  out.  Besides  evidently  too  much  pressure  was  used  during  bonding  because 
the  heel  of  the  bond  Is  vtr-  thin.  rig.  14  shows  purple  plague  on  the  bond  lifted  d»rlng 
the  centrifuge  test  (also  see  rig.  3).  rig.  15  shows  the  bond  resialnlng  In  sore  detail. 

By  Mans  of  the  microprobe  add-on  to  the  SEM,  contaminations  on  top  of  IC'i  can  be 
identified  or  shorts  traced  to  material  transport.  Voltage  contrast  or  electron-berm- induced 
current  pictures  can  show  opens  In  a metaliaatlon  or  shorts  of  junctions  £ 17j. 

In  order  to  determine  junction  depths,  diffusion  depths  and  bond  profiles  cross- 
aectloning  should  be  performed  and  the  diffusions  made  visible  by  colouring  them  either 
by  depoalt.lonlng  of  copper  or  by  etching.  Interference  fringes  can  be  counted  in  monochro- 
matic light  to  determine  the  dimensions  of  interest  (i.e.  oxide  thickness). 

This  kind  of  evaluation  la  Invaluable  in  determining  the  quality  of  components  and 
should  be  used  to  complement  any  other  testing  of  the  reliability  of  electronic  components. 


2.2.  DESTRUCTIVE  ENVIRONMENTAL  TESTS 
2.2.1.  SALT  SPRAY 

In  the  salt  spray  test  a fine  mist  of  salt  solution  Is  sprayed  onto  the  component. 
This  test  la  an  accelerated  laboratory  corrosion  test  simulating  aeacoat  atmospheres. 

There  is  however,  no  direct  correlation  between  resistance  to  salt  spray  and  resistance 
to  corrosion  In  other  environments  £lj.  Even  though  the  prediction  of  absolute  corrosion 
resistance  is  very  difficult,  from  the  result  of  this  test  a relative  Information  can 
be  obtained  concerning  the  uniformity  and  thickness  of  protective  coatings.  Also  as  a 
method  of  checking  the  homogeneity  of  a coating  process  this  test  is  valuable  bv  comparing 
the  tests  to  former  results.  Of  course  this  corrosion-causing  test  is  a destructive  one. 


2.2.2.  HUMIDITY  TESTS 

Usually  humidity  tests  are  accelerated  tests  performed  at  high  humidity  and  high 
temperature.  An  example  is  the  test  performed  on  plastic  IC’s  described  In  the  previous 
paper  [21}.  There  in  addition  a bias  was  used. 

The  moisture  penetrat:s  through  any  leaks  and  through  plastic  materials.  Absorption 
of  moisture  can  result  in  swelling  of  that  material  that  may  cause  rupture  to  bonding 
wires,  metallzations  and  may  also  cause  loss  of  mechanical  strength.  In  some  cases  also 
the  Immersion  of  components  into  liquids  such  as  salt  water  may  be  used  as  a test  of  the 
hermetlcity  of  a seal.  Because  of  the  penetration  of  humidity  this  Is  a destructive  test. 


2.2.3.  BAROMETRIC  PRESSURE  TESTS 

This  test  la  performed  to  almulate  operation  in  aircrafts  at  high  altitudes  or 
satellites  In  tne  transfer  phase  to  their  orbit.  The  purpose  '.s  to  test  the  resistance 
of  sealants  to  pressure  differences  that  exist  in  high  altitudes.  Besides,  lower  con- 
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vectlon  coo.ing  nay  causa  thermal  problems.  Tha  breakdown  voltage  of  air  Is  reduced  in 
high  altitudes.  Due  to  outgasslng,  especially  In  higher  flying  spacecrafts  but  also 
in  aircraft  corot.a,  discharges  and  even  complete  electrical  breakdown  nay  result.  Also 
because  of  sure  arcing  the  lifetime  of  electrical  contacts  such  as  In  switches  and 
relays  be  reduced. 

2.2.4.  FLAMMABILITY 

Resistant.  to  burning  *s  very  important  for  the  safety  of  both,  air-  and  spacecrafts. 
Prlsiarlly  the  ability  of  a component  to  support  combustion  la  tested.  For  flammability 
tests  the  heat  of  the  flame,  the  volume  and  surface  of  the  component,  time  of  exposure 
to  the  flame  have  to  be  known.  The  flammability  degree  Is  determined  by  the  following 
paraawtters  [ 1 ] 

- the  time  until  the  fire  extinguishes  after 
application  of  a flame 

- does  a part  burn  violently 

- does  an  explosive  type  fire  occur 

- is  the  spreading  of  fire  on  surface  of 
larger  parts  inhibited 

Besides  this  support  of  coedbuatlon,  it  is  very  important  that  corona  discharge  on,  or 
heating  of  a component  does  not  start  a fire  on  the  part. 

2.2.5.  RESISTANCE  TO  SOLVENTS 

This  test  Is  especially  important  for  certain  plastic-coated  components  such  as 
styroflex  capacitors  which  by  certain  solvents  can  be  harmed  considerably,  in  ultrasonic 
cleaning  baths  only  such  solvents  can  be  used  which  do  not  do  harm  to  the  encapsulating 
plastic.  A further  purpose  of  this  test  is  to  make  sure  that  markings  of  components  will 
not  become  illegible. 


2.3.  PHYSICAL  TESTS 

2.3.1.  SOLOERAB1LITY  AND  RESISTANCE  TO  SOLDERING  HEAT 


This  test  Is  based  on  the  ability  of  wires  and  components  to  be  wetted  by  a coat  of 
solder.  Thus  the  coating  of  the  component  Is  checked.  In  the  test  accelerated  aging 
simulating  storage  of  at  least  6 months  is  somestimes  Included.  Host  Important  It  is  in 
this  connection  to  verify  that  at  the  suggested  mounting  distances  no  harm  Is  done  to 
the  component  during  soldering. 


2.3.2.  TERMINAL  STRENGTH 


This  test  shows  whether  the  terminals  of  a component,  the  leads  of  an  IC  can  with- 
stand the  mechanical  stresses  exerted  on  It  by  installation  in  or  removal  from  circuits, 
ror  different  types  of  terminals  different  procedures  are  necessary.  Radial,  axial  or 
tension  pulls,  twisting  or  bending  forces  are  applied.  After  the  application  of  the 
stresses,  investigation  with  the  microscope  for  breaking  of  seals,  cracking,  mechani- 
cal v tortion  has  to  be  made.  Electrical  measurements  can  show  interruptions  or,  for 
instance,  resistance  changes  in  a resistor. 
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An  example  chows  how  important  this  terminal  tiro  gth  teat  la.  It  was  noted  that 
the  leads  of  IC’a  for  a space  mission  just  all  came  locte.  Further  investigation  showed 
that  the  manufacturer  had  a problem.  Traces  of  the  etchant  used  to  etch  the  oxide  off 
the  Kovar  feed-throughs  bc.ore  gold  pitting  them,  was  trapped  in  microcracks  of  the  glass 
insulator.  Lateron,  as  humidity  washed  out  the  etch,  it  attacked  the  leads  and  they 
finally  simply  fell  off.  Teats  by  the  manufacturer  could  not  have  shown  this  defect 
because  only  after  some  time  the  etchant  had  weakened  .he  leads.  This  experience  stresser 
the  need  for  incoming  inspection  and  quality  evaluation  as  described  above. 


2.4.  DESTRUCTIVE  ELECTRICAL  TESTS 

Some  electrical  tests  are  by  their  very  nature  destructive  tests.  As  example 
dielectric  breakdown  and  the  test  of  the  input  protection  circuits  of  MOS  circuits  are 
given. 


2.4.1.  VOLTAGE  BREAKDOWN  IN  DIELECTRICS 

This  test  may  be  used  to  make  sure  that  a component  can  work  safely  at  its  rated 
maximum  voltage.  The  test  however,  can  also  be  used  to  show  how  far  away  from  actual 
insulation  breakdown  or  corona  discharge  the  rated  value  is.  It  then  is  a destructive  test. 


2.4.2.  TEST  OF  INPUT  PROTECTION  CIRCUIT  OF  MOS  IC’s 

As  shown  previously,  the  percentage  of  failure  in  MOS  circuits  due  to  overvoltage 
at  the  input,  is  quite  high  [21].  Figures  16  and  17  show  the  input  protection  of  a 
C-MOS  Silicon-on-Shapphire  (SOS)  inverter  circuit,  which  consists  of  a MOS  transistor 
with  a low  breakdown  voltage  connected  from  gate  *o  source.  Other  manufacturers  use 
the  three  diode  circuit  [2iJ  which  seems  more  effective.  But  in  order  to  determine 
the  efficiency  of  the  protection  circuit  a test  is  suggested  which  tests  out  of 
one  lot  a few  samples  for  the  maximum  voltage  they  can  withstand  at  the  input. 

A test  circuit  as  shown  in  Fig.  18  is  used. 


rig. 


18i  Test  Circuit  for  MOS 
Input  Protection 
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A variable  voltage  power  supply 
charges  a capacitor  to  the  pre- 
determined voltage  as  SI  is 
closed  and  then  SI  is  opened  and 
S2  closed  to  apply  the  voltage 
to  the  input  of  the  device  under 
test.  The  protection  circuit  then 
has  to  discharge  the  capacitor 
before  dielectric  breakdown  of 
the  MOS  gate  oxide  occurs. 

050  pF  and  R-2K  simulate  the 
capacity  and  the  series  resis- 
tance of  the  human  body  because  that  is  how  most  of  the  static  is  applied.  The  test  can 
be  performed  to  check  whether  the  sample  IC's  withstand  a certain  voltage  negotiated  with 
the  manufacturer  or  the  voltage  can  be  incre»«»d  until  breakdown  occurs  to  determine  the 
safety  margin  present  in  the  actual  rating.  This  type  of  test  is  to  be  Included  in 
future  Gfw  specifications  of  MOS  devices. 
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CONCLUSION! 


Concluding  the  need  of  reliability  testing  at  the  conpor.ent  level  shall  be  stressed 
again.  M.A.  HacCrehan  Jr.  has,  as  published  [22]  , found  the  following  figures  for  the 

relative  cost  of  finding  a defective  part 


- 

part  screening 

» 1 

- 

black  box  assembly 

• 3 

- 

system  (several  black  boxes) 

» 8 

1 think  this  demonstrates  very  well  the  need  for  reliability  testing  of  components 
even  though  testing  also  adds  to  the  costa. 
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classified  no  onff  three  different  Type*  The  study  of  oo eft  typo 
of  meMont  mo  probobritty  of  occurrence  *un*ch  K*o  to  bo  reduced 
«n  ardor  to  mrroooo  mo  safety  «0  vary  useful  to  Netp  rno  dOQignor 
of  o now  project  to  chooM  botwoon  poee4*e  oofutwno  tolung 
wto  account  mo  roAobrlrty  Of  mo  oyotomo  mo  poodOOo  human 
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The  Concorde  f'»yht  Control  System  •*  discussed  w«m 

•t»  performance  »#i-#b«i.Tv  and  beh*v*©'  m Right  ftooorbto  future 
dovwop moots  pro  COn*»d*'*d  Author 
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14  4 

The  report  daoenbao  vthOu*  retiefrtify  prodict^n  tacbnrqwOO 
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AVIONICS  SYSTKMS 

1A  M Sobort  M 6pr>eont>«ugga  and  A M Schei'U  America' 
Sot  i#ty  tor  Qualify  Control  Inc  p 581  592  1969  in  Amoncon 
Sot.*#ty  tor  Quality  Control  Annual  Torboicoi  contyonco  23rd 
Loo  Angara*  Cal. I May  5 7 1969  TRANSACTIONS 

Application  of  mo  Martov  (.him  method  to  avKXKt  woapom 
systom  roltatx.ty  rpn  «ficat»c>n*  Tbr*  system  starts  with  tbo  Mission 
protUo  wbrch  »s  a d*rant.tat'vo  dwsc'iption  of  functions  that  tb# 
equipment  must  pem»«m  and  tbo  period  uf  lima  over  wh<h 
♦besa  functions  are  expected  to  perform  succestIuHy  faitu*#  *atos 
a»a  collar  tad  tor  the  romponents  of  the  system  and  these  a*a 
•or mutated  into  a Markov  i ham  equatmn  which  establishes  th# 


probabilities  of  mission  tuccoos  Tbo  successful  appAration  of 
m*t  tochrxguo  has  bean  demonstrated  m oirst.ng  awomes  systems 
such  as  me  S LS  and  ibo  ! 106  S M 


A 72  32441  • Tbo  mftuanca  of  a—onec  igMipmawt  of  mtmwh 

bmakaopmg  ft  1b  Howard  (GECMarcon.  Electronics.  Ltd 
Chet rns lord  Eufi  England)  In  Managing  to  be  on  time  A total 
ty stem  approach  m aircraft  operations  ftoyal  Aeronautical  Society. 
Spring  Convention.  London  England.  May  10.  11.  1972.  frocoed 
mgs  London,  Royal  Aeronautical  Society.  1972 

19  p 

Search  tor  possible  improvements  m airime  timekeeping  «b>cb 
could  result  from  the  avionics  aspects  bv  dm -ding  tbe  study  mto  two 
ma«or  parts  m flight  oqn 4(kk>v  and  aircraft  unser «»ceat>l'ty 
A » .onics  wiM  affect  mainly  tbe  categories  of  weather  MOV  teebnicat 
and  engineering  M5V  and  an  traffic  (5X1  Other  causes  account  tor 
the  remaining  70%  An  ad  weather  larvJmg  capability  should  remove 
most  of  the  weather  delays  and  the  additional  equipment  -nvoieed 
should  not  increase  the  level  of  dr'ayt  <n  the  technical  and 
engineering  categories  'f  th*  operation  of  the  *H  weather  system  >t 
not  dispatch  a>t>cai  If  appears  that  total  improvement  .n  delays  of 
up  to  15\  n^ght  be  the  aim  tor  aircraft  >n  current  service  -f  •!  it 
accepted  that  the  proposed  electronic  additions  are  not  dispatch 
rt.f»c*l  1 In  th#  future  fly  by  w.re  CCV  (Control  Configured 
VehicNI  requirements  and  scheduled  all  weather  landing  w»H  demand 
a chc  qr  m emphasis  and  such  elements  will  become  dispatch 
rritrcei  ' E ft  L 
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eviamea  aqwpmewt  K A Pullen  > <US  Army  Ballistics  Research 
Lalwratones  Aberdeen  Prtwmg  Gr.iund  Mtl  l In  Asiiomar  Con 
ference  on  Circuits  and  Systems  6th  PaiifK  Grove  Calif  November 
15  1 7 1972  Conference  Record  North  Molly 

wood  Calif  Western  Periodicals  Co  t973  |t  154161  6 refs 

Because  of  the  nature  of  electronic  un.ls  the  impact  of  * 
project.)#  or  fragments  on  n will  osu**iy  either  produce  an  immediate 
(less  tfwn  on#  second)  K kill  for  the  unit  or  .f  will  Survive  As  a 
practical  matter  improvement  of  survivability  *s  conveniently 
whieved  by  use  of  parallel  processing  paths  thereby  making  the 
target  many  times  more  vulnerable  Attention  q given  to  the  serres 
redundancy  problem  and  ground  loop  control  ll  is  shown  that  voev 
• Hativefy  vmp*e  changes  may  lead  to  substantial  improvements  of 
survivabtMy  m electronic  equipment  for  use  on  aircraft  and  also  that 
with  properly  designed  protective  equitmsent  the  arrangements  to* 
providing  the  redundancy  need  not  introduce  significant  failure 
problems  of  their  own  ERL 

A73  273S4  • Improvements  m the  use  of  E AA  reeeureei  for 

system  perfeimance  assurance  D E Babcock  (Stanford  Research 
Institute  Menlo  R»rk  Calif  1 In  Redo  Technical  Commission  for 
Aeronautics  Annual  Assembly  Meeting,  Washington  0 C 
November  9 10  1972  Proceedings  Washington 

0 C Rad  o Technical  Commission  fo*  Aeronautics  1972  12  p 

Methods  are  needed  fo*  assessing  system  performance  and  for 
estimating  system  costs  What  •!  sought  .s  a means  for  pvmg 
adequate  visibility  to  the  talent  features  of  the  system  that  require 
attention  either  from  a performance  o«  cost  viewpoint  In  general  it 
•s  feasible  to  prepare  a definition  and  descr-phon  of  the  National 
Airspace  System  (NAS)  and  to  create  performance  measures  and  set 
goafs  for  NAS  performance  It  o recommended  that  **fe  cycle  mode*s 
*or  a)'  major  system  elements  should  be  eslaN-shed  and  mamtsmed 
that  system  cr«t*caMy  be  analyzed  and  that  a plan  should  be 
formulated  to  allocate  resources  E ft  l 
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RfifhN  iWoeftyewem.  A M Smith  (General  EWcfttc  Co . 
Philadelphia.  Pa  I end  T 0 Me  Meson  (United  Air  Lines.  Inc  . San 
Francisco.  Calif  I In  Annual  Reliability  and  Mamtamafrlify  Sympo 
s*um  Philadelphia.  Pa.  January  2)25.  1973  Proceedings 

New  York,  Institute  of  Electrical  and  Electronics 
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Engmeen.  Inc  1973.  p 3641 

Th«  tmdKvgi  of  • »tudy  of  tha  r*<*iior>Wvp  between  lasting  and 
the  eebwwrmem  cf  ettectiveneu  m aerospace  iytiemt  er» 
MWTw>/*d  The  study  «M  conducted  by  the  AIAA  Syiwm 
Efkett*i»enn  and  Safety  Technical  Committee  and  cownd  various 
*pec*  of  mt  prof- am  igqoiremenn,  philosophy  and  experience 
•rtf'  speoecr#*v  launch  vehicles.  DOO  aircraft,  and  comam^oal 
»KC«aft  The  cone  k<  on  it  that  accept  an  o»  test*  play  a taw -than 
dominant  rota  *r.  tha  achievement  of  systems  #fftct»venes*  V Z 
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In  avionics  advanced  technology  hat  brought  great*  com 
plenty  with  arid n ut#  being  made  and  increated  reliance  being 
imposed  on  more  and  more  components  Complexity  however.  may 
increase  unreliability  to  wholly  unacceptable  levels  threatening 
safety,  confidence  and  economy  Built  »n  test  equipment  can  make  a 
t'frxficem  economic  contribution  by  allowing  correct  diapiosn  on 
the  fli^d  hne  and  making  ,t  unnacestary  to  remove  serviceable  units 
The  benefits  and  challenges  of  new  technology  and  coat  effective 
ref • ability  are  considered  As  would  be  expected,  problem*  m 
reliability  are  m proportion  to  the  degree  of  sophistication  or 
«echnok>gK»t  advance  m avionics  equipment  f R L 
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The  Workshop  represents  a cuimmetion  of  eimoe’  tt  a years 
of  effort  by  the  Jomt  Technical  Coordinating  Group  on  Electronic 
Equipment  Re'iebrfity  UTCG  EER)  wh*ch  was  devoted  to  a series 
of  investigations  for  improving  reliability  and  procurement  practices 
related  to  microcircuits  After  making  substantial  progress  on  its 
device  < elated  protects  the  JTCG  EIR  decided  to  organ*/#  the 
Electronic  Systems  Reliability  Workshop  m order  to  address  the 
system  refiebriity  problem  and  to  consider  means  of  developing 
improved  management  procedures  documentation  standards  and 
analytic  and  testing  techniques  for  producing  more  reliable 
systems  The  Workshop  was  organised  into  seven  work  groups 
namely  Acquisition  Reliability  Management  Operational  Rel«abrf 
ity  Management  Reliability  Testing  Rehebdrty  Documentation 
Ret  .ability  Analysis  Reliability  Design  Techniques  and  Software 
Retiebrfity  GRA 
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(Theorie  at  pratique  da  la  fiebdite  das  eqmpemvnttl  M M Ravier 

(Compaqn*  National**  An  f«ance  Pain  fiance)  l 'A*ro***uttQue  ef 
rdvfriviauriquv  no  42  1973  p 18  24  In  F»er*th 

Some  of  the  theoretical  and  practical  aspects  of  the  maintenance 
and  reliability  o*  avion**  system*  ar  reviewed  Oncuswd  topics 
include  The  actuarial  approach  to  tenure  expectant  y as  a function  o* 
aqr  acceptable  irhebiMy  cnteria  u*rw»ce  hte  e« tension  and  rehabili 
ty  maintenance  routines  and  manufacturer  aut-ne  liaison  M V E 


A 74  38SB3  Avionic  equipment  reliability  and  low  life 

cycle  coet  W R Petr. go  lUSAf  Avionics  Laboratory.  Wright 
Patterson  AfB  Ohio)  and  J L Easterdav  fBattelle  Memorial 
Institute  Columbus.  Oh.ol  In  NAECON  '74  Proceedmgs  of  the 
National  Aerospare  and  Electronics  Conference.  Oayton.  Oh.o  May 
13  15.  1974  New  York. .Institute  of  Electrical 

and  Electronics  Engineers  Inc  1974  p 521  532  1?  refs 

Basic  activities  m the  conduct  of  a reliability  program  are  related 
to  technical  program  aspects  management  visibility  and  control,  and 
philosophical  concepts  o»  a reliability  program  Questions  of  initial 
or  prep* am  planning  a*e  examined  The  program  manager  must 
make  certain  that  a realistic,  ach«evafrle  goal  is  defined  for  the 
reliability  program  A program  manager's  checklist  is  presented 
Major  managenient  fu*vt'ons  are  summarised,  tak.ng  into  account 
the  evaluation  o*  the  ji  tuat  status  of  each  activity  in  relation  to  the 
yiht-du<es  reliability  task  status  ifpoits.  and  reliability  monitoring 

G R 

Systems  Research  Labs  Inc  Dayton  Oh*o 
DIGITAL  AVIONICS  INFORMATION  SYSTEM  DESIGN 
OmON  DECISION  TREES  Report.  3 Dec  1S73 

IS  Apr  1S7B 

Kenneth  O Potter  and  Duncan  L Dieterty  Jun  1975  51  p 
(Contract  733615  74  C 4019) 

IA0  A014333/9GA  AfHRL  TR  75  2912))  HC  S3  75/Mf 
S2  25 

The  DOOTt  for  a DA»S  system  were  developed  to  determine 
the  deenuon  points  m a design  process  which  may  be  of  importance 
*n  protecting  the  input  of  new  technology  on  human  resource 
parameters  The  DOOTs  for  the  0AIS  system  were  refined  through 
the  process  of  extensive  revaluation  by  experts  m the  field 
both  m industry  and  the  Air  force  They  were  then  used  m 
another  phase  of  the  study  to  actually  determine  the  design 
choice  impact  on  selected  human  resource  pa -a meters  The  00DT 
technique  aNows  fer  a rather  extensive  evaluation  of  the  Ces*gn 
choices  to*  the  completion  of  a total  system  In  addition  to  the 
major  purpose  of  the  OQDTs  for  this  research  protect  as  a tool 
for  ass<stmg  m quantifying  human  resource  requirements  of  various 
technologies  they  may  be  used  lor  a senes  of  other  management 
actions  GRA 
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Section  2. 

DESIGN  FOR  HIGH  RELIABILITY 


N 73  29249#  Rockwai  I ns  am*  tonal  Co'p  Anihtim  Calif 

Etaclronca  Gnxai 

BUMVtVASLE  A CHANNEL  METAL  OXIDE 

BE  MIC  ONOUCTOA  IAMOBI  COMPUTE*  DEMON  Exp 
W»Mrt  20  Mat  20  Up  1*72 

Daryt  T Butcher  Howard  Maddos  and  Robod  L Nsalaqn  Mar 
1973  135  p 

(Contract  F3391 5 72  0 732  AF  Pro,  3176) 

IA0  756199  C7 2 446/501  AFAt  T9  73  311  A vaJ  NTlS 
CSCL  09/2 

Th*  e*grwhc*nc*  of  th«*  propel  to  th*  A*  Fore#  « tha  fact 
that  it  provides  itMttmtnt  and  davakro*  specification*  for 
•mploymam  of  advanced  radiation  hardaoad  hakl  effect  Metal 
Oxide  $em*co**tfuctor  iMOS)  and  Matai  Nrtnda  OxkJ* 
Sam  conductor  'MNOSl  tachoo*og«e*  for  military  space  computer 
•yatama  Tha  ch*i*ci*nt»ics  and  capab*M*«  of  the  dav*ca  and 
pacfcae*ng  tacboologn*  raquuad  for  M0S  MN0S  computer 
construction  ara  defined  and  compared  to  tha  techniques  and 
hardware  requirement*  for  long  lifa  computar  •yatama  A 
computar  archrtactura  rt  derived  from  tha  compariaon  anafyt«t 
{Author  Modified  Abstract)  G9A 


N 73  22999#  9att**bc  Haaaarch  l aba  Aberdeen  Proving  Ground. 
M*d 

EFFECTS  09  91 DUNOANCY  ON  SURVIVAL  Of  C9IT1CAL 

AVIONICS  EQUIPMENT 

Raata  A Pollen  Jan  1973  36  p raft 

(OA  Pro,  1T6  62709  A 068) 

(AO  757152  B9L  M9  22661  Avail  NTlS  CSCL  09/5 

Tha  daaipn  of  armpta  circuit*  capable  of  keeping  cammurwce 
»«on#  equipment  m oparation  undar  condition*  o<  fa*  r*  of  vital 
•action*  or  tub- units  of  a system  ara  d**tnbed  Anafyaaa  ara 
included  which  indicate  possible  routes  for  tmprovamant  of 
equpmertl  *orv"veb4*ty  *>  a battlefield  type  environment 

Author  IGRA) 


N 79  21076#  Hughes  Aircraft  Co  Cuhrar  Gty  Calif  Display 
Systam*  and  Human  Factor*  Dapt 

BREADBOARD  HIGHLY  RELIABLE  VfNTICAL  TV  DIM  LAV 
•VITIM.  PHAM  2 Final  Papon.  11  Mar  II  Oac  1974 

G Wolfson  and  B W Keller  Fab  1975  96  p 
• Contract  N62269  74  C 0342) 

(AD  A006241  MAC  P75  44R  MAC  Rnf  02 143)  Avail  NTlS 
CSCL  09/5 

Tha  tasks  part  or  mad  war*  two  fo*d  First  a stata  of  tha- art 
C9T  was  evaluated  m an  effort  to  vei'dete  tha  C9T  lift  modal 
developed  during  Phas#  II  and  to  relate  CRT  performance  to 
i amiability  Tha  aacond  task  was  tha  development  and  fabrication 
of  k*y  element*  of  tha  programmable  symbol  generation  with 
tha  obftctrv*  Of  p'OVKJmg  improve  3 parformanca  and  reliability 
Thasa  kay  afamani*  included  tha  fuMd  refresh  mamory  mamory 
input  format  k>g<  mamory  output  format  logic  post  proc***©r 
and  mastar  timing  and  control  Tha  effort  expanded  »n  th* 
davalopmant  of  thasa  kay  *i*m*nts  has  ratultad  m significant 
achievements  wh<h  should  la  ad  to  both  mcraasad  symbol 
ganaratoi  parformanca  and  reliability  G9A 

A7V1S933  Operating  syt'tm  raliabdity  for  tha  Navy 

ash  anted  avionic  digital  computar  Ronald  S Entner  (U  S Naval  A* 
Systems  Command  Washington,  0 C I and  Edward  H Benoit 
II  og»con  Inc  , Falls  Church  Va  1 IEEE  Trtmsctfont  on  A mo  soar* 
*n<f  E'ectrcntc  Sytternt  vol  AE3  7.  Jan  1971.  p 67  72  5 raft 

Tb>i  \.*par  discusses  reliability  aspects  of  a modular  mult* 
ptoerv-or  currently  under  development  by  the  Naval  Air  Syitemt 
Command  The  operating  system,  or  executive  of  thu  computer  may 
be  implemented  »n  various  ways  These  include  a totally  lotTwar* 
floating  executive.*  one  defeated  ro  a static  protestor  or  an 
executive  confuting  of  special  purpose  hardwa.e  The  objection*  to 
hardware  executive*  especially  for  avionic  application*,  include  • 
supposed  degradation  m system  reliability  Thi*  paper  show*  that 
order  certain  condition*  thi*  degradation  need  not  occur  (Author) 


A 72  16574  A Bayttun  analy,-*  of  avionic  subsyitem 

thrift  m test  E C Harmon  (General  Dynamic*  Corp  Fort  Worth. 
Tex  1 IEEE  Tfsnuctmni  on  Aerotpacr  and  Electron*  Systems  yol 
AES  7 Sept  1971.  p 98,  987 


A m*|or  deve’ jpment  m te*t  philosophy  of  aircraft  being  built 
today  and  Thov  being  deigned  for  the  immediate  future  it  the 
incorporation  of  on  t>oard.  computer  controlled  built  m*  testing 
(BIT)  mto  the  airplane  a*  part  of  the  avionic  *ub*v*tem  A 
requirement  being  imposed  by  aoday'*  specification*  i*  a probability 
of  0 95  or  better  that  the  Bl*  function  will  detect  a failure  It  i* 
*hown  that  a single  specification  of  BIT  capability  »s  insufficient  to 
completely  define  the  teouirement*  for  BIT  The  proof  of  thu 
conclusion  is  offered  m the  form  of  an  analysis  of  the  conditional 
probabilities  involved  m th*  occurrence  and  reporting  of  subsystem 
failure*  (Author) 

A 72  36691  Modular  tviontc  oowiputar.  E C.  Gang! 

(USAF.  Aeronautical  System*  Die  . Wfr.ght  fattarsos  AFB.  Ohio)  In 
NAECON  '72.  fhocaadmgi  of  tha  National  Aerospace  Election** 
Conferenca.  Dayton,  Ohio.  May  15-17.  1972 
New  York.  Institute  of  Electrical  and  Electronics  Engineers.  Inc  , 
1972.  p 24*251  11  ref* 

Thu  paper  proposes  a modular  avion*  computer  concept  that 
can  b*  easily  standard* red  Snca  the  advent  of  large  avion*  systems 
th*  Air  Force  has  bean  plagued  with  a multitude  of  diverse 
processor*  throu^sout  tha  aircraft  Thasa  computers  are  always 
dissimilar  and  create  • tremendous  support  and  inventory  problem 
Thu  paper  suggests  $ modular  computer  concept  that  could  be  used 
wherever  sequential  processing  it  required  m the  aircraft  Its  devyi 
permit*  many  different  appJ<at>oni  by  tailoring  it  to  (he  task 
through  microprogramming  (Author) 

A72  37032  a listafvrty  of  flight  control  ay  stem  design  I S 

M/nt  (Smith*  Industrie*.  Ltd  . Wembley.  Middx  . England)  Atnr»ft 
fngmoarmg.  vof  44.  Ally  1972.  p 4.  5 

Determination,  for  airborne  systems,  of  the  affect  of  ts. lures  on 
tha  a tr worth* nett  of  an  aircraft  Th*  limit  on  acceptable  unrebabdity 
shows  that  economics  are  nos  permitted  to  A date  where  safety  n 
concerned  In  general,  things  fad  because  they  are  over  stressed 
Electronic  component*.  **d  hence  systems,  follow  th«s  rule  Various 
methods  of  improving  reliability  are  outlined  If  it  is  required  to 
show  m arhance  of  m service  experience  that  certain  failures  of  a 
system  have  • very  low  probability,  there  •*  no  practical  alternative 
to  that  of  d» signing  a system  with  redundancy  so  that  th*  failure  rata 
of  its  constituent  parts  can  be  established  m a reasonable  time  and 
computation  of  the  effect  of  redundancy  carried  out  F R L 


A 73-1 7572  » DAIS  • A iwy  cross  read  m the  dsMlopment 
of  evforuc  systems  B List  IUSAF,  Avionics  Laboratory.  Wright 
Partsrson  AFB.  Ohio)  AitronmtKt  and  AmormitKt.  vd  11.  Jan 
1973.  p 5561 

Th*  Digital  Avionics  Information  System  (DAIS)  •*  discus  tad  as 
a new  approach  to  meat  tha  requi laments  of  mjdern  military 
supersonic  all  weather  precision  weapon  delivery  systems  operable  by 
small  crews  Tha  approach  described  provides  ability  to  modify  an 
avionic  system  by  means  of  software  rather  than  hardware  changes, 
and  to  uta  modular  or  common  equipment  design  in  different  typa* 
of  aircraft  Further  it  give*  a significantly  greater  total  systam  mean 
time  between  failure*  (MTFBI  through  the  planned  use  of  radun 
dancy  at  subsystem,  equipment,  and  component  levels,  and  a peeler 
flexibility  of  adding  new  sensor*  and  capabilities  to  the  system 
without  rewiring  tha  aircraft  VP. 


A7332490  Onboard  electron*  equipment  optima  at  ion 

and  rsfiidswcy  (Ophrtmabon  das  Iqupamsntt  Hectromipiw  da 
lord  at  re  bond  sure)  J da  Cor  lieu  (ThomaorvCSf . Bagnaux. 
Hauts  da  Same,  Franca)  In:  Electronics  and  cml  aviation.  Inter 
national  Conferenca.  Pari*.  Franca.  June  26  30.  1972,  Reports 
Vokim*  1.  Pant.  Editions  Ch*ron.  1972.  p. 

377  384  In  French 

Th*  ophmustion  of  redundancy  m application  to  onboard 
#♦*<"••  .m.  equipment  for  civil  and  military  aircraft  if  discussed  In 

particular,  tha  hypotheses  underlying  the  concept  of  reliability  are 
reviewed,  along  wrth  future  tthtfs  m tha  philosophy  and  practK.es  of 
reliability  and  redundancy  MV  t. 


A7i13M  Co*?  iWictn*  bwit  M Ml  to#  advanced  •*- 

craft  •iectncH  ryatene  H 8 (own  (U  S Naval  Material  Command, 
t4*val  Am  Development  Center , W*#mm»ttr,  Ptl  and  H W 
He m /men  (LTV  Aerospace  Co»p..  Vought  System*  Qi«  , Dalle*, 
7e*  > In  Automatic  support  systems  for  advanced  maintainability. 
International  Symposium  Arlington.  Tea  . November  5 7,  1973, 
Record  New  York.  Institute  of  Electrical  and 

Electronics  Engineers.  Inc..  1973  p.  5J  60.  7 rets 

This  paper  presents  a method  tor  utilizing  the  data  handling 
portion  of  the  SOSTE  L multiple*  system  to  provide  a cost  effective 
built  m test  (BIT)  capability  to  isolate  faults  to  the  line  replaceable 
unit  (L RU)  The  evolved  techniques  provide  a rtieens  tor  determining 
the  health  of  each  of  the  7048  input  and  2048  output  controls  which 
are  mwtt'pteaed  by  the  system  In  addition  four  techniques  to 
automatically  test  the  data  handling  circuits  are  also  discussed  The 
BIT  system  as  defined  it  efficient  small  m we  and  weight,  and  cost 
effective  because  most  of  the  data  circuits  are  time  shared  to 
accommodate  BIT  data  The  BIT  data  is  used  inflight  m the  solution 
of  power  management  equations  to  permit  programming  of  redun 
dancy  and  safety  interlocks  Two  types  of  maintenance  displays  are 
discussed  a maintenance  panel  and  an  onboard  strip  printer  The  BIT 
system  it  compatible  with  air  togreund  data  link  to  maintenance 
data  (Author) 

A74  39929  targe  Kale  integration  application  for  satellite 

on  board  processing  R K Gexjer  (U  S Navy.  Electrons  Systems 
Command  Washington  D C ) (Armvd  Forces  Communications  end 
electronics  Association  Annus/  Convention.  28th  Meshing  ton  D Cl, 
Jun*  f Ml  1974/ Sign*.  *o»  28.  Aug  1974.  p 42  44 

More  efficient  satellite  relays  can  reduce  the  requirements 
concerning  the  large  number  of  terrestrial  elements  in  the  Navy's 
communication  networks  LSI  technology  could  improve  com 
muhications  spacecraft  performance  with  the  aid  of  on  board 
processing  On  board  processing  includes  any  function  wh.ch  may 
after  direct,  control,  store,  or  inhibit  the  signals  relayed  by  the 
spacecraft  One  of  the  mejt  uonrficent  features  of  LSI  technology  is 
h.gh  reliability  The  M.TSATLOM  fleet  broadcast  equipment  is  the 
first  LSI  implementation  of  on  board  processing  G R 

A7S-234B7  Impact  of  avionic  deign  characteristic*  on 

technical  framing  requirements  and  job  performance.  K W Potempa. 
R S.  Luckew  (USAF.  Human  Resources  Laboratory.  Wright 
Patterson  AFB,  Ohio),  and  L.  M.  Lett*  (McDonnell  Douglas 
Astronautics  Co.  St.  Louis.  Mo.).  Human  Fee  tors  vol  17.  Feb 
1975.  p 13  24  9 refs  Contract  No.  F33615  71  C 1620 

This  study  was  performed  in  two  phases  The  first  phase 
concentrated  on  the  influence  of  avionic  desiyi  and  technical 
trammg  fKtors  on  student  performance  The  second  phase  deal  ith 
the  impar  t of  design  and  personnel  factors  on  the  perform.  4 of 
technicians  m operational  A *r  Force  units  Aviomc  components  were 
scaled  on  a variety  of  design  characteristics,  and  data  were  collected 
on  the  task  time  and  error  performance  of  students  and  technicians 
performng  a functional  checkout  maintenance  task  on  the  compo 
rwnts.  Personnel  data  were  also  obtained  on  each  subject  Multiple 
regression  equations  were  then  developed  to  predict  task  per  for 
mance  from  design  characteristics  and  personnel  measures  The 
multiple  R’t  for  students  were  0 S3  for  time  and  0 82  for  errors.  The 
multiple  R't  for  technicians  ranged  from  0 60  to  0 88,  depending  on 
the  type  of  maintenance  and  criterion  measure  used,  all  R's  were 
significant  at  the  level  of  p less  than  0 001 . (Author ) 

ATS  26720  * Digital  eviomesoverview  • Airframe  mem* 

facturar’s  vr  my  point  R Dunn  <Bo*>ng  Commercial  A.ipiane  Co  . 
Seattle  Wash  > American  institute  of  Aeronautics  and  Astronautics 
P'S  te!  Avionics  System  Conference  Boston.  Mass  Apr  2 4 1975 
Paper  75552  6p 

The  system  requirements  »n  new  aircraft  a»e  related  to  changes 
regarding  the  criteria  used  to  rate  the  worth  of  an  aircraft  Aspects  cf 
aircraft  economics  no.se,  and  ecological  considerations  have  become 
very  important  Better  performance  at  lower  costs  can  be  provided 
by  a utilization  o*  advanced  dg>ta>  technology  *n  place  of  t*>e  analog 
systems  employed  »n  present  ancraft  Research  and  development 
programs  conducted  *n  tne  a»<?a  of  digital  technology  by  an  American 
aerospace  corporation  are  d trussed  GR 

A7S2672S  * Fli^tt  critical  digital  control  system  evalua- 
tion L E Fairbanks  (General  Electric  Co  Binghamton  N Y ) and  J 
E Ttmpleman  (Boeing  Commerc  il  Airplane  Co  . Seattle.  Wads  ) 


American  Institute  of  Aeronautics  and  Astronautics,  Digital  Avionics 
System  Conference.  Boston,  Mass.,  Apr  2 A,  1975,  Paper  75  566  15 
p.  6 reft.  Research  sponsored  by  the  U S Department  of  Transport* 
t*on. 

Tht  flight  controls  development  study  task  was  dev*  oped  to 
permit  technology  investigations  into  selected  areas  of  triple  channel, 
tail  operational,  analog  and  digital  system  designs.  An  application 
model  based  on  a flight  critical  control  system  is  considered  A 
system  description  is  given,  faking  into  account  the  laboratory 
configure*  on  and  analog  subsystem,  the  incremental  control  p o 
cesior  subsystem,  and  the  whole  word  computer  subsystem  Perfor 
mance  comparisons  are  discussed  along  with  aspects  of  software 
development  and  control.  Attention  .%  also  given  to  the  preflight 
test/failure  mode  eno  effects  studies  G R 

ATS  31129  An  advanced  fault  isolation  system  for  digital 

loy«c.  N.  Benowitz.  D F Ca'noun,  G.  E.  Alderson  (Hughes  Aircraft 
ro..  Data  Systams  Dw  , Culver  City,  Calif  I.  J.  E.  Bauer  (U  S Navy, 
ivaval  Air  Engineering  Center,  Lekehurst,  N J ),  and  C T Joackel 
(US  Naval  Material  Command,  Naval  Air  Development  Center, 
Warminster,  Re.)  /£££  Transactions  on  Computers.  vo»  C 24.  May 
1975,  p 489  497  8 refs  Contract  No  N62269  73  C0132 

Built-in  test  (BIT)  techniques  for  cost  effective  fault  detection 
and  fault  isolation  to  a digital  subsystem  and  to  the  faulty  module 
there  m are  described  The  OR  of  resulting  module  pass  fail  signals 
indicates  subsystem  faults,  where  as  identification  of  a module  fail 
signal  provide*  isolation  to  a faulty  module  Coding  techniques  are 
discussed,  with  tradeoff  of  speed,  test  effectiveness,  end  log»c 
requirements  for  each.  It  n shown  that  less  power  and  fewer  units  are 
necessary  for  the  same  level  of  performance  and  reliability,  since 
only  one  rather  then  three  units  must  operate  to  eliminate  failure 

$D 

Uhrasystems.  Inc  Newport  Beach  Calif 

FAULT  TOLERANT  AVIONICS  SYSTEMS  ARCHITECTURES 
STUDY  Find!  Report 

Lei  R Murphy  Algirdas  A Aviziem*  David  A Rennelt  Lyle  D 
McNeefy  and  Roger  L Fulton  Jun  1974  490  p 
(Contract  F 33615  /3  C 1 163  AF  PROJ  I 
(AO  784879  74/8  20  24  AFAL  TR  74  1021  Avail  NTlS 

The  report  presents  the  results  of  a study  to  apply  fault 
tolerance  techniques  to  avionics  systems  architectures  Tb.s  study 
included  the  following  tasks  HI  definition  of  a general  avionics 
baseline  system  consisting  of  integrated  p^ol  controls  and  displays 
Strepdown  inertia)  reference  unit  fly  by  wire  automatic  flight 
control  subsystem  multiples  data  bus  and  distributed  computation 
network  (21  development  of  a fault  tolerant  avionics  dumbuted 
computation  subsystem  (3)  development  of  optimum  avionics 
system  pensioning  redundancy  implementation  and  •• 
dundency  management  techniques  (4)  development  of  subsystem 
fault  detection  isolation  and  recovery  techniques  and  i5*  analysis 
and  determination  of  the  costs  versus  benefits  of  fault  tolerant 
avionics  system  design  (Author* 

Am  Force  Avionics  Lab  Wright  Patterson  AFB  Ohio 

AN  INTRODUCTION  TO  FAU  IT  TOLER  ANT  OEStON 
TECHNIQUES  Technical  Report 

Thomas  E Tyson  Jun  1975  38  p Supplement  to  report 

dated  Jun  74  AD  784879 
(Project  Af  2003) 

'AD  AO 1 3934  AFAL  TR  74  334) 

This  report  introduces  the  concept  of  fault  tolerant 
architectu<es  and  surveys  general  techniques  for  the  design  of 
fault  tolarant  systems  The  techniques  discussed  are  for  digital 
systems  or  systems  that  can  be  visualized  as  being  digital  m 
nature  'Author) 


Messer schmtt  Bofkow  Blohm  Muenchen  Germany 

INTEGRATION  OF  THE  COMSAT  AVIONICS 
(INTEGRATION  OER  AVIONIK  VON  KAMPFFLUGZf UGEN| 
W altar  M Vogl  5 Jun  1974  4 p In  GERMAN 
(74  060049) 

Usmg  the  eaample  of  avionics  the  concept  of  a system 
testing  is  explained  wh*ch  permits  investigation  and  mtegratwn 
of  comple*  airfreme  airborne  weapon  systems  already  during  the 
development  phase  under  a broad  range  of  realistic  combat 
conditions  The  purpose  of  this  *s  to  install  an  already  fully 
functioning  weapon  system  mto  the  airframe  An  optimization 
method  it  described  which  has  been  worked  out  for  this  form 
of  system  development  It  is  particularly  *u»ted  K*r 
high  performance  combat  aircraft  (Author) 
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Section  3. 

SELECTION  OF  COMPONENTS  AND  PARTS 


N 72  19097#  Army  Electronics  Command  Fort  Monmouth  Nj 
f toctron<»  Tachnotoyy  »nd  D«y*c«i  lab 
t NGtNIEPING  (VALUATION  OF  AIRCRAFT  9ATTERIES 
Sytvu  Dwa  Jul  1971  36  p raft 
<04  trot  1T6  62705  A 053> 

(AD  733269  ICOM  3456)  A«*  NTlS  CSCL  10  3 

Changas  m imchU  lee  hue  logy  *o<J  advao  n m atocuonre 
•rtd  etoetncal  •quomtnt  <to*Kjn  have  caused  increased  demand* 
tor  atoctnc  p ower  Batlenet  m the  and  lightest  design 

rtHitt  be  capable  o*  delivering  h.gh  rate  currents  und*f  all 
ambwnt*  tor  starting  power  have  good  high  rate  cha'Qe 
•u*pi*nci  and  be  available  m the  fully  tha*g»d  state  m ctw  of 
emergency  Th#  raport  detail*  ail  tha  problem  areas  evaluates 
th#  various  secondary  electrochemical  systems  m tarma  of 
a«rc« ah  um  describes  tha  »eoe*iQn  #Hons  of  the  Military 
Sarvicat  and  presents  « critique  of  speoheeton*  covering 
arrciaft  batten—  Author  <GRAI 


N72  32241#  Barafca  Corp  Sidney  NY  Electrical  Component# 
Ora 

REUA9U  INTI  GRATED  WlAI  TERMINATION  OtVICEB 
•omtoncw—l  (apart,  1 Jul  31  Dm  1971 
0 L Ptondtor  and  D M Gould  Jun  1972  13  p all 
(Contract  0AA907  71  C 0090  OA  Pro,  1F1  62203  A 1191 
(AO  744479  (COM  0090  21  Avert  NTtS  CSCL  Of  1 

Tha  jutpoaa  of  tha  nvaHipilwa  a to  cow*  the  de—gn  and 
evaluation  of  a w*g  termmgtio*  system  capable  of  interconnect  ton 
to  a variety  of  mufti  contact  connector#  such  as  cyto*b*cei 
rectangular  rack  and  panaf  printed  orcurt  board  and  tamunaf 
function  dome##  Tha  conaectiv#  da»ica»  ars  to  ba  capable  of 
aaaamhN  and  mamtananca  with  a common  toof  fear  t#rmm#i 
marton  and  withdrawal  fn  add* am  tha  vaout  conneciwo 
dmcat  shji  ha  capable  of  retwbfy  wrthetendmg  tha  amnronman 
tat  conditions  ancountarad  by  both  ground  and  autoem#  A/my 
equg>ment  Primary  amphasra  « o*ected  toward  a a«gnrAcant 
improvement  of  tha  rehebrtrtv  and  mamtamabtoty  of  — nng 
systams  w Army  aucraft  Pretype  toot  aampfaa  contormnq  ms 
2’0  tarmmato  he—  baan  fsbcsfsd  and  t— ted  Prototype  taat 
■smptos  contaaung  ma  20  tarmmato  (both  matert<  and  Ostoctnc 
etention)  ara  bemg  febnered  and  wdl  ba  evaluated  eccordmg  to 
tha  praparad  taat  procedure  Term*—  ween  ton  and  removal  toofa 
hava  baan  raws  ad  and  «4  ba  avatoatad  xcorOnp  so  a taat 
pracadu/a  to  ba  praparad  Author  (GRA) 


N 73  22144#  Sparry  Rand  Carp  St  Paul  Mmn  Defense 

Systams  0n» 

MKDIUM  tPt  (0  MASS  RANOOM  ACCI99  MIMORY 
MOOULK  (mat  R apart 

Robart  A Whrta  and  Gtonn  M Krueger  Goff—  AF9  N Y 
RADC  Jan  1973  34  p 
(Contract  F 30902  99  C 0325) 

(AD  755937  PX  5407  50  RADC  TR  72  33 1 ) Avert  NTlS 
CSCI  09/2 

Tha  obtoctha  of  tha  program  «s  to  develop  a preproduetton 
modal  of  a sohd  stats  plated  swt  memory  moduia  to  oparata 
m an  auboma  or  tactical  ha*d  environment  w.fh  a command 
and  control  sysiom  computer  Ths  moduto  *m  design  ad  wdui 
tha  bee«c  constraint#  that  tha  completed  10  mm**  M moduia 
to  both  random  accasa  m at  retnovai  mods  and  roiiabia  w a 
lacteal  haVJ  appKation  ah  as  th#  cost  par  bn  of  th#  moduia  m 
product**  rsmansl  sufficiently  low  (SO  0 1 to  90  015  per  brt) 
ta  ba  accsptabto  to  th#  usars  Th#  moduia  waa  rtsi  pr sj 
fabricated  and  tasted  to  tha  r*bu«*m#ots  of  MIL  ( MOO  ovar 
an  oparatmg  range  of  0C  to  55C  les*ce»y  tha  hnai  anvuonman 
tat  taat  restate  bor#  out  tha  design  entana  w that  tha  moduia 
waa  feuccasetoay  tastad  tor  shock  wbration  hgmdty  tfc  without 
any  evidence  of  s^nrheam  design  probtoms  Th#  moduia  * 
praeantty  at  Roma  Air  0sv#iopm#nt  Cantor  where  rt  to  schadtoiad 
tor  use  a venous  A*r  Force  appheettone  Author  <GRAI 


A72  34993  Hybrid  LSI  togtc  modutos  .or  —respect  J A 

Gene  S M 5tiy*lh»<t.  end  R ( Thi^1  (R«vfhron  C<j  bmtffvd 
Mess  ) In  (toetrontc  Conyion#ritt  Cont— *■#  22*Hj  Rf/sh»ngton 
OC  .May  15  17  1972  Pr.esrrt.ng,  to»Y,.k 

Institute  of  (isctiK-sf  and  (toctronet  Eoyrwu  I nr  1972  p 
195  200 


A set  of  hybrid  LSI  loyc  modutos  has  been  dtv#4oped  which 
provides  architectural  building  biodks  for  a w*de  range  of  aerospace 
and  military  dip's!  systems  An  order  of  magnitude  increase  in 
density  and  refietolity  has  been  achieved  ovs*  conventional  integrated 
circuit  pectepng  techniques  by  the  combined  use  of  passivated 
beam  toadad  TTl  arrays  and  oe«amie  based  hi^i  density  «nter 
connection  networfei  This  concept  becomes  technically  and 
economically  feasibfs  through  the  use  of  v> tensive  automation  in 
layout  design  mask  making,  and  test  genmtti on  The  paps*  descr-bes 
the  ve>  *ous  technology \ emofoyed.  the  des*gp  automation  techniqtys 
devetooed  and  tha  logic  functions  rt^itomenred  (Author) 

A72  34999  * Ttctoipitt  tor  cantrel  of  long  wo  rvf lability 

of  oompiei  integrated  circuits  I Reliebifrty  — urawc#  by  test 
vehreto  peairfication  N 9f  Van  Vonno  (Harris  Sem^onduttor 
Melbourne  F'a)  (n  Electronic  Componems  Confer«nc*  7?nd. 
Washington  DC  May  15  17  1972  Proceeding 

New  York  Institute  of  Electrical  and  ('•ct»on*ct 
Engineer  t Inc.  1972  p 4634f6  5 refs  NASA  support* « research 
Development  of  an  alternate  approach  to  the  conventional 
methods  of  reliability  assurance  for  large  seal#  integrated  circuits 
The  product  treated  is  a laru'  scale  T squared  L array  de.gned  tor 
apace  applications  The  concept  j«ed  is  fhjt  of  quaiif*cat»on  of 
product  by  evaluation  o»  the  basic  processing  uo-d  m fabricating  the 
produci.  prov>di«g  an  ms.p*t  m/o  its  potential  ref>ab<i>ty  Test 
vehicles  are  described  ertnch  mabie  evaluation  of  device  character 
istics  surface  condition  and  various  parameters  of  the  two  level 
n 'te<!>/aiion  system  usei  Evaluation  of  these  test  veh<tos  >s 
pertormed  on  a tot  qu/iif*catmn  bas  s w*fh  the  tot  consisting  o*  one 
wafer  Asaembtou  test  vehicles  are  evaluated  by  h»pt  temperature 
stress  at  300  C for  short  t*me  durai-orn  Stressing  at  these 
temperatures  provides  a rap*d  method  o»  evaluation  and  permits  a 
go/no  go  dec«SKjn  to  be  made  on  the  wafer  lot  m a tim#fy  faahron 

(Author  i 

A 7} 32499  Awafyeto  #f  tfei#  rdtobtoty  of  totod#  t— Ra n#f 

m an  awtos#  an—pany  Obyaatoeaa  and  mdad  (L  tdy  da  la 
Nabdto#  da  nnlnd  tetort  dana  tana  aaeapagma  tfnaaas  ONtokb 
at  nMwdto  J.  L Lesaga  (Saertototot  GanPrai  $ t'Avtohon  Cw*to 
Par»s,  Franca)  In  (toclromcs  and  cwrf  prtobors.  I waar national 
Conference,  Par»t,  Franca,  June  29  X)  1972,  Reports  Voiuma  2 
Fais,  I ♦ tons  Che  on.  1972  9 977990  In 

French 

AH  mayor  —rl.net  carry  out  a permanent  fo*towup  of  th# 
raltabdrty  of  thee  —borne  meter i—  Oman,  th#  methods  wtrlmd  at 
A*r  Franot  ara  not  unique,  and  can  ba  found  •«  other  European  and 
Amartoan  countries.  Thn  h due  to  the  vary  good  relation#  wh«ch 
net  bahoaan  th#  tech  meet  servicas  of  differ  erst  rompanos  wh< h 
favor  tha  aechanga  of  mformation  or  rsaw  methods  RahatoHy  a 
dr*mad  as  a method  of  mamtammg  safety  at  an  accaptabto  toeaf.  and 
a method  of  reducing  coats  In  the  course  of  the  leal  tan  years  the 
balance  sheet  of  rai«abrlity  tfudwt  at  A«r  Franca  has  baan  largely 
positive  F R L 

A 79  34731  Fwto  <e  anafysw  wad  to  vmdaesa  JANTX 

•anvonanto  R : Peopto , nbestm^touse  Oetonse  and  Electran< 
Syst—  m»e«  tod  I In  Etort'omc  Con*x»nems  Cc**** 

ente  2erd  Washington  DC  toev  14  19  1973  Procaadm^ 
New  V o«k  Institute  Of  Etotfr  *cai  and  Etociron>o 
Engineers  Inc  1973  p 349  >»4 

With  me  re  wed  emphas-s  on  reliability  >«  government  contracted 
systems  more  stungem  requirements  ha—  been  placed  on  sarmcon 
Ctortor  components  resorting  n the  tolL  S 19500  JANTX  toll  S 
38510  and  Mil  ST0  993  specifications  The—  specifications  add 
processing  and  power  canon. on.ng  to  1 JON  of  the  components  >n  « 
tot  submitted  for  accept  a ce  as  a JANTX  type  poor  to  inspection 
tests  to  verify  Lot  Totoic#  Percent  Defective  ILTPOi  The  post 
mortem  e mam. nation  o*  JANTX  component  reject. on  occurring 
Ctonng  the  venous  stages  of  test  n the  manufacturing  of  an  -rborne 
etoctron.es  system  has  shown  that  the  fpluros  were  mamiy  associated 
w*th  c»»Cu'f  design  manufacturing  and  tost  probtoms  and  these  wer# 
resof—d  th»<x>#h  appropriate  corrective  action  Anafysn  o*  tfete 
totores  pa  eyed  a central  role  n determ-nmg  the  most  affect*— 
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(0"Vrt'(*  Kt'On  4*»d  n fy,rN  thjt  th#  JCt'C*'  had 

ji  h*v*ed  He  de\ *rd  irvJt  E A l 

A/4  20969  OC  10  aviomct  part*  reliability  m review  H S 

6a**-n  A C.  1<*N  £*m*'  Cat  ♦ » I*'  Annua. 

Me'.jpMy  #n-t  Vjntj-n^.Mv  ,J*'"|imMirt'  In  A-r^'**  Ct"t 

January  29  31  19’4  P-  nwilngt  Nnw  >,v* 

Institute  Ot  ( i#i  T'h  j'  jrtd  E 'W  •'•>«*.  V f n<jirw»tM\  lm  19*4  P 

403  40H 

The  S»,  CVv'n»|i  Dnutt'Js  0«  U)  *.m«4M  pr<R*»am  derru** 
*trJted  the  e**th  « n*  4 r*.  ’’’tie*  nt  »e*-.*bii  ty  a»*f  quaM* 
r*H)iWi«H|  ■ pnttj/%  **«|  V’tjti'e  jm.jng  then*  teve*a 

h*-v  io^M'Iv  on  em  tm  »'  fi#  I'.kh  j»wl  *-ei  t»  >.*tt  aqnet.i  ue*tt  'M 
T*v  a*ion*»%  4*4te">4  A .|U4'  'I%>n\  1*  l>«*t4  control*  4 

jvnwnted  wT**'/  'Hj  LK.  ^0  v 4V-  " v'-H-m  ie¥-.»al  part  4e.u»e  p»ot* 
*4  4 b#V4  *•*»  d-v  utu-M*  Jf  *t  ♦-»•♦  mlMJf  ->*  the  »eijtive 
*•♦  *h»  »'S  1 h«.  '>'•*'■•  • he,*  ^>'41'  mint 

« ri^'  ♦ * u.dgnt  *,  *n«.  n ,..*  » * ♦*»*  • '*•♦.,  wk -rn  ^ 

* - d»*0  egw.ymer**  '«.  4ti  4'»*  t • l»4*t  ♦.*•-»'♦*  ’-tKy’  -H}  * 'J<yV4 

and  >Or>ytt‘,e  4»  *»-'»  2 iVii-t  il'f  JUT*  li'  JigtftBBnl  Jml  '3 

m*  hr\> if'jtxjr*  #»v1  .'*  •*■!  '>»  ••■  u f iur*  Authp* 

A74  3SS19  Or>e<h>o  ttotei program  mtfntix  bubble 

prcKftMi  H A Nj  j'Mf  J C.  I <Te«J%  l»nHuWnM  Cenf.Jt 

Research  LaborJtjres  Pai-as  T**  • In  N At  CON  /4  ftiKttO  ^ 
of  the  Netonat  A#>vtp4i»  #•'<1  £ifct'«>f"«»  0 ay  ton 

Jh  o Vj>  13  1%  1974  Nrm  Yof%  Htf-tute  o* 

Eec?ftji  and  Electro'-*..*  I'lfwt  Inc  1974  p 42  49  Cont*art 
No  F 336  ’9  73  C 1029 

A one  ch  p **«gn»t-f  1‘otitve  puj^»*m  piocenio*  tl»i^n#d 

*or  *.H»r*#t'on  *n  ve»*>f  n'-Me**  •"'»  dr%cti&rd  E »pev ted 

lily*  I U tK'  ■*  in  tt>*  |I(|  ,d  Vd  t4ted  <.d»'1»Ol  Ad**rt«gfrt  **» 
e*i>*cT*d  ovei  4 co^iKit-’-q  iK'vw»  equ'»4*#ni  *»nn.conckiCtL'f 

4-ocrtkO'  •••  r*^e  etn  of  o - ^4»d»'e%>  «ve-^t.  lo'u^f 

i-w-vaf  <c*'  *nd  »e*.4t»  t t>  T^r  p*  « ■ p4«d  *o»  tVie  #d%4nu^*  >t  • 

On.  kpned  pt  1000  p»-i  vrcond  Howie*r* 

r » Ur*  eved  tt*4f  ..ompi.v'Hj  the  4.094^  cti.p 

peifcnjr  #•  d •«  '',^1  xupt>"« ! e»et!»on#c»  *«-'»  he  4^441  4^0 
•^•P  ei'Oog^  to  4t>*-4i1  tniu,(qhoot  4«<onav  >y4tpm«  »o«  d'4t» 'hut-nq  . 

**«■  lompuimq  load  (Auitvyl 


Th#  h • of  bu'n  *n  of  f«p«ir  p*rl«  #nd  (ft#  f«H«tK»n  to 
of  op#** t*o*Vf»  •Qu<>m#nt  >•  ionvd»i»d  of  *«*«ot*on  pf 

rhi*  rot#  #i'h  tn#  l#v#i  O#  »#P#I»  P#d  '«  • P#n  b*#cfc 

boil  f o<  minmuffl  iuppoM  o*  op#»#t.o«»#i  #Qu<i>m#ni  of 
n«#nuf#*  uli»«#  * *#v^o,>t4>»litv  of  |ullifnlliC'  of  th#  r>><jh  (Mt» 
of  t>u*n  >n  14  ( r»»t  «ff#ct*v«  on  • tog>«tK:»  tuppod  t>#*-4  of  »n#ff4#« 
txi«n  m of  '#p#«<  p#(U  •**:»••*#»  f1»#t  support  #'#  •■#m.no<J 

Lofttl  of  born  m «f*  *owt*n./#d  to  f»V'4*9f'f  9##l  koppo'1  «mp»cl* 
P'«nc<>*#t  rt#4»#*op#<1  *n  #v«#tK)n  %uppiy  of*»c#  to  <^o*d# 

#U#0»*khr*Htnt  of  %pe<  if*  burn  m •#Qu«*#m#ntv  ««•  pr###nf«d  It 
•4.  COntJuded  th#t  born  m of  r#p#«r  p#d»  c#m  Of  b#  t###n  Iq* 
gr#r  t#d  «t»  #<  onomn  ♦mp#<t  <*  too  g'##t  Ritommynrtiloo* 
•*#  m#»te  to  »*p#nd  on  tt>#  prtrx  >p*#»  fO  #apoM  t»>#  p'ub*«my 
#n<J  to  provide  better  input  inform#!**’  do>*’g  tb#  prov»««on»ng 
procee.%  1 AuffW 


A/4  4S14S  Murwumutmt  tnwlowwn  A k.uilu>  iAjv« 

4M<le«  AwVko  l*tt  Nee«»f»4n'  M^.gbts  Mnt  * #»nl  M CmM#'  1 Bo-  .*4> 
*>t  Megnetti  Ct»*p  R<*no»#  mI  C#i*f  • 'imtitut*  of  f*+~fr>c* 

end  £ fctromct  fnf n^n  Annu#f  /niemjfionjy  Vjfevi  Con 
Nrence  f/rb  Tononfo  C#n#d#  4f*y  74  7/  79/4/  /iff  ?>#n* 
#rr»pn*  on  ffydM  vm  MAG  10  Sept  1974  p f<9f*  700 

ffegu-rementt  *Of  m.C»«m.n. Jfure  Ir#n4t,jrmrf4  #nd  'Kluftort  -n 
#r»<no#c#  4ppt'C#t'0*'4  er  he.ng  met  m tb  4 »■»**  o«  1 8 n #r*d  1 4 .n 
Cube  un»t»  Theye  n fsfw  mer%  *rr  usnl  tor  Judo  fjr'-e*  hioed 
bend  end  pu«e«  vopp* * 4erv.ce  »n  te'e^ete' -nq  #mpi  f.er*  'nert.e 
9u*denrt  Vy>tem<  end  other  jppr-CJt  'irn  The  Pjn4ft*mer4  jre 

mjnu#JCto*ed  n th  ! jm,nj»-pfH  end  b»»bt>n  eo^nd  co*»4  u\uel!y 
under  micrmcooev  to  e^jct  f4g  eiecTr>rei  jnd  en».ronmenfJt  regu.rr 

menn  Spec  * mjn<jf  jcturinq  4»'d  Te4t  equ  pmenf  h^  peer'  deveiopett 
bee  jute  o<  the  m,c»t*n.n.jtore  \>tr  Tvp.cj<  rjt-ngi  29  mtA  fo« 
the  1 8 -n  cube  ?00  mtA  fi>»  the  1 4 n r.it^  Tht»^  typ.rjl 
jpp<  cjtion*  jr*  too  bed  i Author* 

P/vy#4  A.'rrjft  f tt jfU’Shment  f jrnborough  { ng< jruj 

output  runm  tom  aiucmaft  tvh 
CYClOCONVf ftTOAS  Tirtimfl  K#p#n 
N J Ceter  Apr  19/1  44  p 
t AO  740633  «Af  TR  71068) 

lh  the  report  th#  p#rform#nc#  of  knv  p###  power  Mtor# 
M«bt  for  The  prime  #fectric#l  power  mppty  m #*«cr#ft  « enefyred 
end  Atcuttjd  Thr##  type*  of  filler  #*e  conpdered  end  # computer 
prog/em  e weed  to  deter  mm#  the  'eeponee  of  the  hftere  wf>en 
k>#d»  of  venoue  power  f#ct«*«  ere  jppfied  The  ervetye*  ronciudee 
that  the  l eecbon  filter  repreeente  the  optimum  arrangement  for 
cycfoconvertr*  #ppAc#t«or«ft  i Author) 


US  NAVY  Aviation  Supply  Ofhce  FhOedetphiJ  F# 

BUM  IN  CON 64 Of  NATION  IN  TMf  MOCURIMINT  OF 
AIM04NC  AVIONICS  AfFAIS  FARTS 

A A Giordano  Oaf  Prep  Aeaoctenon  tNaehmgton  0C  1974 
14  p logrthre  An  emerging  technology  meeting  r«po»1  fod 
Lee  V#  fee  26  27  1974  p 11  24 
i75  0426781 
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Section  4. 

ENVIRONMENT  CONSIDERATION 


A 74  JIM]  Ahtwed  M>i«oNn»iul  town*  ay  team  A C 

'USA7  Flight  Dynam.c*  VS-  petTe'»<>n  Af  R 

O'  o'  In  NAfCOh  U Aioreedmg*  O4  *!ye  Na’-ona*  Aeicnoare  *«i1 
|(‘i  Co»’,f»f"iT  Payt**n  o 1)  May  13  15  1974 

Ne*r  l*yTtu?e  o*  |iet»»«fe*  end  tieft'o»M-% 

E‘tg".e*iy  1974  0 108310 

Th*  »1rw*-hr<1  e«,  »ii»ime**iai  control  *yllfw  \ Ur-ng  drno  .jped 
to  prov.de  h.^>  'e*>4h>  »v  o*  4*'f»4»*  y»jl*,wem, 

De  veiy  o*  4 trady  supply  o*  fife*'  < PO»  d»>  41  i*<1r'  #j*  » «-iv 
ccv'd  t.pr**  <\  #*yu*e<1  hy  ,»s  ng  a*  improved  h»4»  truer  at.  h 

ro»*tx*4t  <7*  to  iy»o*f  fttett  ve  y 4'9r  Ot  mo%»u»r  *nd  V 

e'.m.r.jy*  njste4u'  *e*r4i  The  qr<  ji  ftw  h qh  (weytu'e  riwtr^s-*  g 
4uto^4l'<  4‘'y  'Otet-  'Q  **4*  e •fhai'<|r'  v <1e*f  - tied  V p 

A/4  Mill  • Aircraft  mmm c»  am  wo nmtrW  cantrq* 

■nefyaM  ffwAaat  1w  aaMiutf  lift  cycle  toil  B T R / A 'US 
Nave*  Malaga!  C N*.*  A.«  Dereu>pmen  Ce^te- 

\A*»m,nyt*i  7*i  S A Campbe"  **<1  A J Tev'r*  'Genera 
Dy'ar*Kn  Co*p  Cc**a''  Aeiouiere  Dv  Sa*  D ego  Ce-  4 1 in 
Natonai  ConVenre  or  |n* 'onmenta  o*  A »r»at*  and 

Aopu't  'r  $yy*em>  *1th  Trento*  N J May  ?1  73  4974  h*«v>ed 
■ngi  Trento*  Nj  US  Na»a*  A*  Aroou'yron 

Tati  Center  1974  18  p 9 -eN  Navy  wDtxvt«1  •rtrart' 

IK*  emt  a*aiyvt  p»ors.du*ey  rons-dered  a»r  oc  icemed  w th  dv 
'>♦*  cvc*e  coti  advantages  of  the  *a  o-n  r*«-r _>«**v'>!a*  ccK’t'o 
tyttem*  They#  p< ocedor*'  fa*  fheiefy'e  ha  u»/d  to  op4  '*'  /»  *N 
e*v  ♦onm#rta<  control  tytte«M  a«ou*<J  i tr  r>cv  cot  f vampies  .j*  a 
jw  c<  fN  procedure*  to/  a tight**  and  a*  ASIA  a-*f»a4t  at  d-vutved 
•t  >y  found  that  o both  ^ aves  ronvde'abV  urn  t*v  ng,  ca*  hr  'ra*  /*d 
by  ut  ' ting  fo*ttaot  ta^pr'alu'r  a*  o*  rt  G A 

A74  3KW  Tha  apphcetior.  of  onwonworol  pmwletHMv 

and  letting  to  rKonnamanc*  watdi  J L Ha*r,  'JSA>  A,  «,*><* 
l A' .gf'i  Pj*t*"u» 1 Af  B On.*.;  t*  NAICON  74  P 

fe^d'H*.,  <*♦  the  Na’o-a'  Aen/t*)#'  r a'nt  I i#tf 
Da, ha  Oho  M«,  1J  1*>  1974  Nro  Vd-I 

l*’,t  tute  (>♦  |irtt*-ta»  a'’d  liartto^Ty  I *><}•'>**»%  »*«  1974  v 

4?1 4?J 

A 7%  1CN2  Imprint  Aaaapa  mi  tut  p««*m 

4*»  of  A C 1 Sock  * (Boo«h«  Aoroapaca  Co  Sotttto  Warft  ) 
Soctory  ¥ fipman,  Abaoh<7  4aroonoro  f tporof 

W MAm/Nrioonp  Mmay  Sot  Om#o  CWtf  . Oct  7 J.  7974. 
7«0f?S  tp  BltfhPm.  *1  7S  hoomomtaon.  W 75 

Ncant  tapavion,*  with  vibrahor  qu47«fic4t«on  of  twohics  Nar 
tha  B 1 prplona  hoi  rt%>aa*ad  daftcwnrwy  ih  comity  uaad  nbrahon 
At«r  phd  taat  procatfurot  Spocihc  arawyptat  of  dahewhooa  ara 
Ptcuaaod  Boco*hhio»«datto«n  N>»  Mhprovih*  vibration  dwrpi  mC 
ptocadum  ora  praaantad  in  tha  arooi  of  arwironihontp  prorhetton 
(paafihcottoh  mtin%  and  uta  of  vibration  no»ator»  S mathona  «ra 
•hyda  ratotiv*  to  vibration  dnfi  and  tat  tin*  m l^pit  of  tha 
try  bah>ra  buy  concap  I Author) 

ATVAhABI  • Camp  ad  hoot  ncMpn  (at  tha  S#ooa 

^mrrda  A B T»uach*ndJ  Noao*  lUn-tad  Anc»att  Corp  Hampton 
Standard  D*v  drmdao*  locfct  Conn  ♦ ASM£  SA£  AiAA  ASHA 
and  AtCt-t  7nRr*wx  <nfy  Conh^anr#  on  f n»*rtvvn#nrw  Srrfama  Son 
f/anr/tro  CW  Ju*  ?!  ?i  7975  A$M(  Ajpor  75  f N4*  54  Up 
Mnmbm  $1  00  nonm».nba*t  S3  00 

I'^itwai^it  danpty  platr  fm  heat  MC^mpu  will  ba  utad 
in  the  Space  Shuttta  Atmoaphe»t  Aevtat*/at*on  >ib«vtteny  1AAS1 
and  n the  7tao*  Coolant  Loop  <7  Cl  » A*  advance  n tha  Mate  o»  the 
art  (>•  compact  heat  eychanpr*  deyipn  hat  bee*  ettected  wth  the  uaa 
o*  t.n  hrMpm  of  0 070  and  0 0C7  in  tin  th<knetaet  The  advance 
provided  a bpniticant  weight  teymgt  to  be  made  on  n>ne  tvpet  o* 
A AS  and  7 Cl  heat  *■  changer*  The  GSf  heat  e»  change'  to* 
evamp*#  provide*  cooling  •*  a core  designed  to  tiantfe*  heat  at  the 
/ate  of  0 43  k*e  cu  ■*  of  core  mctod.ng  a »edundant  cooling  pmi 
The  a*»  to  wate*  mate*  to  7 »eon  ?1  7 'eon  ?t  to  7 ,eo*  7V  7 »eon  71 
to  7C  40  7 reon  71  to  Hydiauiic  tiud  heat  e» change*  conf>gu'atK>rn 
are  den ' 'bed  A mnnay  of  analytical  de*»gn  techn^uet  t»ade  of* 
ttudwt  and  te»t  retu It t a«e  prevented  at  wet*  at  the  at  ***oarh#t 
tefected  *o»  handling  up  to  f >ve  heat  trantpod  t'vdi  •«  a wngu  core 
unit  I Author  l 


ATS -4009  2 • Coat  attache  - newt  gf  refngarsted  at*  tar 

aeeeet  e— ling  on  wide  bwfv  commercial  aircraft  A S Borcmow 

(Dr^ugiat  A.fC'a4i  Co  long  Beech  CaM  l A3M£  $A£  4/44 
ASJAA  and  4 >C*(  ConUrrenr#  pn  f'H/'TWne^ra 

Srrfwni  San  frwx.go  C*>*  Aj>v  ?1  ?4  7975  ASMf  Pw 
75f%4>9  I0*i  $100  nonee^UrM  13  00 

The  emty  aiWK  *tni  n t*  I'.t.ei  iHii-vruvr t ma-nte  »<c»  ard 
Hun  pro*  v<K'">g  o*  nlH'tl  MKi'pmr'M  ten  cu,r*nr  u/hnyfi*! 
ai'C*a4t  acce*tuetr^  trw  -vrrd  to  keep  »hr  cmT  o*  tmr'ie'th'p  to  4 
m.n.mum  Th.»  pa*re*  i1>u  avtrt  The  t’aileo44!  '^vO'ved  n add-'ig  a 
'rt*  p'li'Cn  ivtTrm  »o'  n o'«-ct  cno*-og  To  'mt»fOve  av*o*«ct ’t  >at>  • 
t y The  rewitt  o4  e»'  e'i'yvt  e»e  p-rv  ted  pa/ameti  ca*'y  *o'  e 
Typ<ai  wide  cxmI^-iI  u«""vi.#  a.'C'a4T  The  firumtetri  vd" 
wh-cn  ret<  <|p-  *1  ik-  1 < n'  e*»e<  * ve  and  f^r  c <*%»  rntuffiy"  acn  -e*e«1 
♦u<  va*>ooi  :>pr‘i,'u''ri  til'd  1 on*  a»e  ite'-T  t^-<1  Autni>«  • 
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Section  S. 

RELIABLE  PACKAGING 


A 72  39796  Nek  aging  tar  tta  tertta  H W Mwkium 

[kH  tron*  Nc*apny  and  Product*)*  voi  •'*  Aug  1972.  p 29,  30. 
33I3H  J 

Ravww  o<  »om#  of  tha  tachniQuat  currently  uwd  and  coo 
tempUtad  for  tha  protection  of  mitttte  guictenca  ttectrpnict  again* t 
tha  damaging  aftecn  of  mtanta  X ray!  and  gamma  radiation  on 
p**Ctron#c  circuit  mafandt  and  tarn  conductor  parformjnca  from 
rxjctaat  Mam  of  ant*bdl«ttc  miaul#  detonation*  *0  tha  vicinity  of 
oncoming  ICBMt  Following  a diacvm^on  of  that#  damapng  affect* 
iHufttrated  by  photopapht  of  circuitry  before  and  aftar  »nte  a#  X ray 
tspoeure.  packepng  technique*  ara  detertbed  that  employ  matondt 
of  low  a forme  numbn  and  high  malting  pomt.  beryllium  #rxj 
magnauom  interconnection  !yiterm  dielectric  i*oiat*cn  for  *emi 
conductor!  and  overload  revstor*  for  <jk!upat»on  of  momentary 
Point  turya*  Tha  technique*  da  act  1 bad  include  a prototype  ttacaad 
multilayer  hybrid  deugn  beam  *-ed ad  intvrconnect  packapng  and 
ttandarrf  *ad  module  design  approach#!  M Vt 

AT?  39799  kviorwct  paduyrg  and  tha  new  dam  and*  H 

W Mark  item  fter-fromr  NrAagmp  and  ArodUrbon  aof  12.  Aug 
1972.  p 52.  54  56  58 

Wwn  of  «oma  of  tha  weight  teeing,  vibration  proofing,  and 
h##t-dmpfmg  technique*  uaad  m ae*onic*  packaging  Tha  electron* 
muttifdaaing  packapng  system  proposed  for  th#  9 1 bomba*  •' 
Pot  to  maka  possible  weight  saving*  corresponding  to  tha 
elimination  of  33  miles  of  wiry  To  ruggrdire  tha  cl Bttfr  and  provide 
haat  TtamHr  thn  tystam  involve*  an  atsemi  v of  two  orcuit  board! 
attached  back  to  back  on  supporting  rath  Rack  mounted  and 
egpetate’  packaging  technique*  ara  also  discussed  M V E 

\733U99  Tha  kkd  9m  ppaad  -HaaUp.J  A 

haatmgi  (Lockheed  Cakforma  Co  . Burbank.  CaM  \ In  HAECOH 
#3.  hr  ocat  dm  pi  of  tha  Ha  bond  Aerospace  Electronic*  Conference. 
Cteyion  Oho.  May  1416  1973  Haw  York. 

Institute  of  I teemed  and  Electron**  Cn^naan  In# . 1973.  p 
3744 

Tha  conva named  black  boa  approach  to  packing  ettemes  * 
cos  tty  It  • oaatfy  not  only  «n  tent  <4  nomm  packing  wwght 
mafhqant  caohng  and  muh^fioty  of  tenteat  qualification 
piagrarm.  bet  use  of  tha  Mack  boa  pproack  mhtem  aapkatabon  of 
now  error!  technology,  batter  compjntn  cooing  and  aaponds^ 
*mgie»mant  of  byte  dnono  Tha  tohihon  to  #m  pattern  a to 
adopt  a ordmnry  cteparturo  from  tha  ueud  tr  alteration  of  black 
bourn  Tha  approach  tahan  * to  moduteruo  and  oowei  data  tha 
atectnamci  packapng  mto  ratetwafy  tew  compertiiwrq  which. 
among  tha  thmp.  accommodatat  dte  ePsancesg  cncutt  bdnotap 
and  afford*  batter  coohng  mdtmg  m unprpvad  rTidtehty  (Author I 
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Section  6. 

LIFE  CYCLE  COST 

N7t-17UI|  A*ro»p*c»  Guxtonc*  »od  M«rotogy  Cantw  N«w*Hi 

Ait  Ponca  Siition  Ohio 

TMM K HM  CtCll  COST  MODELS  FOR  INERTIAL 
SYSTtMS  Ftoal  Raped 

Sobo<i  | Ada!  J Sooner  and  Karth  J Gibson  4 Apr 

1974  50  p 

IAD  A0004S3  AGMC  74  Oil  21  Avail  NTlS  CSCl17/7 

THo  porposo  of  Ibis  report  wM  to  rh*®«  difVent 

Cycls  Cost  mc*Hs  to t tnornsl  systems  to  tha  mambwaNp 
of  tha  Li  to  Cycto  Com  Teak  Group  of  Jomt  Sonnets  Dsts 
Cschenga  tor  I name!  Systam*  tor  tha  purple  of  tontovaruelion 
p»»o*  to  ths  Aprs  1974  maatmg  of  thst  group  m Anahatm. 

Cst'tom-s  Th*  to port  dsscnbss  thraa  Uto  cycto  com  modato 
thtt  hsvs  bssn  ussd  m aconom*  snslysis  of  »nsrt»sf  navigation 
•V*t*rr»  Author  (GRA) 


A'/ 4 3SSS2  Lift  cycto  cod  companions  of  avion*  system 

design  tHemttsva*.  P S Kilpatrick  and  A L Jones  (Honeywell,  Inc  , 
Minneapolis.  M*nn  ) In  NAECON  74  Proceedings  of  ths  National 
Aerospace  and  Electron*:!  Contsrtncs,  Dayton,  Oh»o,  May  13  15. 
1974  New  York.  Institute  of  Electrical  and 

Electronics  Engineers  Inc  . 1974  p 514  520 


A75442H  Cod  of  ostwrAf  An  ortnss  tits  cycto 

oust*  ItowHto  of  awonre  *ydem  rehabrirty  improvements  H A 
Brode  (Hughs*  Aircraft  Co  . Canoga  Park,  CaM  I In  Annual 
Reliability  ar* I Memt  a*. ability  Symposium,  Washington,  D C , 
January  2S  30.  1975.  Proceedings  New  York. 

Institute  of  Etoctr.ee!  and  Electronics  Engineers.  Inc  . 1975.  p 
212216 

A definition  of  life  cycto  cod  i*  provided  and  an  evomes  life 
cycto  cod  model  it  presented  Two  computer  programs  are  utilized 
One  model  generates  development  «nd  investment  phase  costs 
Another  model  computes  operating  and  investment  phase  support 
costs  The  output  of  both  models  is  combined  into  one  computer 
pmtout  Attention  is  given  to  the  calculation  of  maintenance 
resource  'equirements.  study  ground  rule*  and  assumption*,  and  lift 
cycle  cod  results  If  •»  shown  that  •!  is  possible  to  reduce  the  lift 
rycto  cod  ugrw fluently  G R 

A 75 -44246  A togot**  analyst*  and  ranking  model 

/ALARM/  to  L Dav<Hon  and  B J Landstra  (Hughes  Aircraft  Co 
Canoga  Park.  Cal.f  } In  Annual  Reliability  and  Maintainability 
Symposium  Washington.  DC.  January  28  30  1975.  Proceedings 
New  York  Institute  of  Etoctr«a!  and  Electronics 
Engines**  Inc  1975  p 538  542 

ALARM  is  a Support  cod  model  uwful  for  the  follow^ 
viurpo*#t  tom  (Station  of  life  cycto  support  cod*  for  a system 
composed  of  mpiaceab'f  subesscmbi.es  determination  of  the  most 
cod  effective  of  alternate  design  concepts  aneiyvs  of  the  sensitivity 
of  support  costs  to  changes  m system  design  parameters  selection  of 
the  most  economy. al  of  tour  specified  maintenance  concepts. 
ident.fic.tion  of  the  basest  cod  components  and  support  elements 
of  a system  The  mod*’  •*  complete  and  operational,  and  hat  been 
used  effectively  m the  evaluation  of  support  of  a comptoi  airborne 
avomes  todem  Th,t  model  products  life  cycto  support  cod 
information  which  it  essential  tor  evaluating  approaches  for  mam 
taming  an  equipment  tydem  Th,t  information  .$  provided  m ctoarly 
defined  reports  produced  by  the  model  on  demand  (Author) 
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Section  7. 
CASE  HISTORIES 


N73  2BMO|  Okljhom*  Cly  Ai>  M.ttr*.  Aim.  TmUf  AFB 
OUa 

LOGISTIC  Rf  RFORMANCf  DATA  BOOK  FOR  A 70  BOMB 
navigation  svbtfm 

Mar  1973  M p tala 

IAO  762215.  A 70  73000/73  1)  Ava^  NTIS  CSCL  15/5 
Th«  report  presents  the  reliability  maintainability  logistic 
support  coal  and  gener*)  product  performance  inform  at  too  on 
the  A-7Q  bomb  navigation  system  It  a purpose  is  to  impart 
Sufficient  logistics  support  history  on  tha  bomb  navigation 
syttam  to  tha  angirvaanng/dasign  community  rapraaantad  by 
AFSC  and  tha  contractors  angagad  m tha  dasign  of  similar 
systems/  subsystems  for  Air  Force  usa  Author  (GRA) 


A 7 3- 176 17  0 Tha  trand  toward  increasing  avionics  com 

plexity.  R C Collins  (United  Air  tines.  Inc  , San  Francisco.  Calif  I 
American  Institute  of  Aeronautics  and  Astronautics.  Annual  Meeting 
and  Technical  Display,  9th,  Washington,  D C Jan  8 10.  1973,  Pafier 
73  28  4 p Members,  $1  50  nonmembers,  52  00 

‘Avionics'  is  defined  as  those  areas  of  application  of  electronics 
to  aircraft  where  an  impact  on  the  operational  safety  or  reliability  is 
present.  Aspects  of  redundancy  are  discussed  which  lead  to  the 
conclusion  that  excessive  redundancy  may  complicate  matters 
unnecessarily  Increasing  complexity  is  the  price  that  must  be  paid 
for  increasing  operational  versatility.  It  is  suggested  that  avionics 
components  could  be  designed  with  a guaranteed  operational  Me 
rather  than  a guaranteed  mean  time  between  failure  F R L 

A73  19403  " Calculation  of  the  reliability  of  electronic 
components  in  an  'aeronautics'  environment  shaped  by  the  opera 
tional  service  routines  of  onboard  equipment  devices  used  by  Air 
France  (Calcui  de  la  fiabilite  de  composants  electroniQues  dans 
I'environnment  'aviatio.i'  a partir  du  suivi  d' ex  plot  tat  ion  dequipe 
ments  de  bords  utilises  par  la  compagme  Air  France).  0 Levy 
(CNET,  Centre  de  FiabiMe,  Baqneux,  Hauts  de  Seme.  France)  In 
National  Congress  on  Reliability,  Perros  Guirec,  Cotes  du  Nord, 
France.  September  20  22,  1972,  Text  of  the  Lectures 

Pans,  Centre  National  d'Etudes  des  Telecommumca 
tions,  1972,  p.  41  47.  In  Fiench 


A73-33086  0 Cost  of-ovmenhip  design  philosophy  for  iner- 

tial nevigetors.  R.  L.  flmgo  (USAF,  Avionics  Laboratory,  Wright 
Patterson  AFB,  Ohio).  Astronautics  and  Aeronautic*,  vd  11.  June 
1973,  p 59-63. 

The  AN/ ASM  101  gimbaled  electrostatic  gyro  aircraft  navigation 
system  (GEANS)  has  from  its  inception  been  designed  and  developed 
to  provide  precision  navigation  with  a low  total-1  ifa-cyde  cost 
GEANS  employs  a unique  gyro,  the  electrostatic  gyro.  Electrically 
suspended  gyros  inherently  have  exceptional  performance  cherac 
tenstics.  The  GEANS  technology  base  is  discussed  together  with  the 
design  approach  used,  questions  of  the  development  technology,  the 
target  cost  structure,  aspects  of  material  cost,  maintenance  action, 
and  physical  characteristics.  The  aN/ASN  101  GEANS  is  now  being 
optimised  to  both  improve  further  its  reliability  and  maintainability 
and  further  reduce  its  cost  of  ownership  G R. 


A 73- 3711 4 0 Guidance,  control,  and  instrumentation  pro- 

gress on  tha  McDonnell  Douglas  DC-  30.  C.  L Stout  (Douglas  Aircraft 
Co  , Long  Beach,  Calif  ).  American  Institute  of  Aeronautic*  and 
Astronautics  and  Goaudarstvennyi  Komitet  po  Nauka  i Takhnika, 
USSR /US  Aeronautical  Technology  Symposium,  Moscow,  USSR. 
July  2*27.  1973.  Paper.  14  p 

The  design,  development,  resting,  certification,  and  initiation  of 
the  present  generation  of  jet  transport  systems  into  revenue  service 
occurred  through  scheduled  phases.  Aspects  of  these  phases  as  they 
pertain  to  tha  flight  g^  ^snee  and  control,  automatic  thrust 
management,  and  area  navigation  systems  of  the  DC  10  aircraft  arc 
discussed.  Advances  in  systems  capability  and  complexity  in  the  wide 
body  pot  aircraft  greatly  increased  the  problems  of  flight  test 
Laboratory  testing  end  simulation  were  used  extensively  to  reduce 
flight  test  time  requirements,  and  an  advanced  data  acquisition  end 
processing  system  wes  utilized  to  support  the  flight  test  program. 

F R l 


A74  20954  Equipment  procured  reliability  and  real  life 

survival  O Markowitz  <U  5 Nav*  Aviation  Smipiy  0*!*«»*  Ph.ij 
delphij  Pa  l In  Annual  Reliability  a»ul  M41nf.5n.9tj  ' 1 j 

Los  Angelas.  CjM  January  29  111  19/4  P*  - * »fr|.«»qs 

New  Yon  ImM  *Te  of  tlertn***'  anti  fin  iiijnvs 
t Im  . 19/4  p 249  255  0 n-fs 

Her  oenmeuiljlions  ,»»«*  injife  r<i»  im|irr>.nuj  itnii>nl,r-ii  Elions 
fietween  suppliers  and  user*,  pf  etjjifirnent  i«:  ttn  .»***.»  of  i«»UaK-  1»  I* 
is  i om  Killed  mat  the  hazards  |fi  »ea!  Me  «nj.. .{i'v»*nf  li  |.,  *nd  *•- .1  .*• 
do  not  i ompare  to  those  inherent  e*j,np»ne*it  i.itmi  a»i»r * 
lion  of  failure  ra*e  Thus  any  1 ' .m>f.it«o»i  of  '.itmrjt  e , ,»t  ■*;»♦-<  ’ -«-d 
f.iiKiie  rate  as  a dne»  t e*p*i  taPoO  .1*  *-n,l  ,.>•  failure  *at»  >s 
inadequate  There  i*  ni.n  h *l»-ed**d  *»v  j*i»-  P the  ope*  at. a *. 

tjndei vt,it,d)iiq  Of  .'.hat  is  i«s|„imiI  tm**-  twnttai  tu*s  n the » .mV«f  o* 
•ehalehty  ,|inl  as  well,  mm  *l  is  Mmlfil  1 ont'.R  ta*  s stand  »v; 

ol  the  • e.ii  life  equipment  flow  ami  ha,- a'  N n*  s,.1  s ■« a’  T *»* 


A74  36555  Improving  Maan  Time  Between  Maintenance 

Actions  A recommended  syl*em  approach  R C Perd/och  UlSAF 
Wnght  Patterson  AFB  Ohio!  In  NAcCON  74  Proceeding  of  the 
National  Aerospa.e  and  Electronics  Conference  Dayton  Ohio  May 
13  15,  1974  New  Ycrk.  Institute  of  Electrics* 

and  Electronics  Engineers,  Inc  . 1974  p 375  331 

A wide  discrepancy  cont  nues  to  ex  st  tietween  Mean  T.m* 
Between  Failure  IMTBFl  foi  pieces  of  av«on*c  equipment  as  dete» 
mined  from  qualification  tests  and  the  Mean  T.me  Between 
Maintenance  Action  (MTBMA)  afta-ned  >n  operation  The  present 
work  discusses  some  of  the  probable  causes  fur  this  discrepancy 
Available  data  indicate  That  major  stfd-^  can  tie  made  by  mprovng 
Bu>lt  In  Test  (BIT)  and  Aerospace  Ground  Equipment  lAGEl  design 
to  assure  that  malfunctions  are  correctly  diagnosed  It  is  urged  that 
reliability  testing  and  test  of  BIT  and  AGE  capability  he  in-hated  as 
early  in  the  design  phase  as  posable  These  tests  should  be  carr.ed 
out  m stepw.se  fashion  to  allow  a test  fix  test  concept  aga<nst 
increasingly  difficult  ts st  requirements  P T H 


A 75- *7139  Rtfwbdrty  lif#  cycle  of  • complex  electron* 

airborne  equipment.  S P.  Mercuno  (General  Electric  Co  . Aerospace 
Equipment  D»v.,  Utica.  N Y.)  and  J.  M.  Black  (USAF.  Aeronautical 
Systems  Div.,  Wright  Patterson  AFB.  Ohio).  IEEE  Transaction*  on 
Reliability,  vol  R 24.  Apr.  1975.  p.  2 7. 

A good  refiability  program  through  design  and  production 
results  in  excellent  equipment  performance  m the  fiekf  A full  life 
cycle  under  controlled  failure  reporting  and  analysis  procedures  ■« 
covered  An  excess  of  48.000  flight  hours  over  27.000  missions  with 
303  failures  reported  from  five  reporting  maintenance  shops  con 
stitutes  the  field  reporting  phase.  In  addition,  details  and  supporting 
documentation  of  the  overall  reliability  program  during  the  design 
phase,  demonstration  phase,  production  phase  and  field  use  phase  are 
presented.  (Author) 


A75  37679  The  F-4E  digital  scan  converter  An  example 

of  reducing  the  fife  cyde  cost  of  avionics  through  diptal  technology 

R J.  Jems  (USAF,  Av.umcs  Letxwetbry.  Wnght  Patterson  AFB, 
Oh.ol  In  NAECON  75.  Pioceedmqs  o*  thv  National  Ae'ospece  e^d 
E Vet  ionics  Conference.  Dayton.  Oho..  June  10  12.  1975 

New  Yo»k  Inst-tut'  o*  Electrical  and  E»ect»onics 
Engineers  lr»c  . 1975.  p 451  456  \ 

A diq*tai  scan  converter  (DSC)  for  the  F 4E  aircraft  -s  described 
which  provides  a means  of  displaying  l»adar  information  attach 
symbology,  and  elect ronp? -cel  sensor  imagery,  an  on  a common 
indicator  The  discuss-on  cover'  system  detcr.pt ton  and  principles  o* 
operation,  two  flight  test  results,  and  life  cycle  cost  analyse  *o«  the 
reliability  and  maintainability  of  the  DSC  equipment  It  is  shown 
that  DSC  exhibits  increased  reKab-My.  ma-nta  nab-My.  and  growl* 
capability  over  the  analog  scan  converte*.  while  simuitaneous'v 
providing  equivalent  operational  performance  S D 
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